GHSA-7jvw-75gf-2h34HighCVSS 8.1
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason ...
🔗 CVE IDs covered (1)
📋 Description
During an upload, curl mishandles HTTP/2 RST_STREAM received from the server
(with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after
free of a struct Curl_easy object.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-92392
- https://hackerone.com/reports/4030333
- https://curl.se/docs/CVE-2026-92392.html
- https://curl.se/docs/CVE-2026-92392.json
- http://www.openwall.com/lists/oss-security/2026/10/18/5
- http://www.openwall.com/lists/oss-security/2026/10/18/6
- https://github.com/advisories/GHSA-7jvw-75gf-2h34