psf-curl-oct2026-check(8)

Script: /opt/psf-security-patches/curl/curl-oct2026-check.sh. Tool page: curl. Source. With the package installed: man psf-curl-oct2026-check.

curl HTTP/2 upload use-after-free, October 2026: read-only checker  (v1)
CVE-2026-92392

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

A use-after-free in libcurl's HTTP/2 upload handling lets a malicious server
that receives an upload corrupt the client's memory, and the reporter turned
it into code execution on the uploading machine. The attack runs from the
server side: the client uploads roughly 135KB over HTTP/2 to an attacker's
HTTPS server (certificate must validate), the server stalls and resets the
stream, and curl reuses a freed handle. Taking over a client needs exact
knowledge of its build and heap, so curl expects most attempts to end in a
crash and rates the flaw High, not Critical. Because libcurl is linked by
many other programs, the exposure is not limited to the curl command.

Affected: curl and libcurl 8.12.0 through 8.22.0. Not present before 8.12.0.
Fixed upstream in 8.23.0, with branch backports 8.14.3, 8.16.2 and 8.20.2.
Distributions backport the fix into their own builds under older numbers
(Debian 13 trixie: 8.14.1-2+deb13u7, DSA-6558-1; Debian 12 is not affected).

This is read-only: it finds what needs updating and judges each against the
fixes. It changes nothing. The fix is to update curl/libcurl and restart the
programs that use it. Where you cannot update, curl's advice is to
avoid HTTP/2: the command's --http1.1 option, or CURLOPT_HTTP_VERSION set to
CURL_HTTP_VERSION_1_1 in an application (a request, since an existing
connection may be reused). A libcurl built without HTTP/2 cannot reach the
path at all.

Usage:
  ./curl-oct2026-check.sh [command]

  check (default)  every curl command and libcurl on the host, and libcurl
                   inside running containers, with whether each carries the
                   fix and whether the build supports HTTP/2. Root optional.
                   Exit 0 = nothing exposed, 1 = a vulnerable curl/libcurl is
                   present, 2 = something couldn't be read.
  hunt             read-only: the journal and logs for process crashes that
                   look like this bug: curl segfaults, use-after-free aborts,
                   programs killed by a crash signal. A failed attack is most
                   likely a crash, so a crash on an outbound HTTP/2 upload is
                   the signal. Exit 0 = clean, 1 = findings.
  version          print the script version.

Env overrides:
  FIXED_BUILDS="8.14.1-2+deb13u7 8.5.0-2ubuntu10.6"
                                    extra distro curl/libcurl builds known to
                                    carry the fix, space-separated full
                                    versions. Checked alongside a built-in
                                    list (Debian 13's 8.14.1-2+deb13u7),
                                    which a value here does not replace.
  CURL_SEGMENTS="8.12.0:8.14.3 8.15.0:8.16.2 8.17.0:8.20.2 8.21.0:8.23.0"
                                    "<introduced>:<fixed>" per maintained
                                    branch; the fix for a version is the one
                                    whose introduced bound is highest at or
                                    below it
  CURL_INTRODUCED=8.12.0            below this the flaw is not present
  SCAN_CONTAINERS=1                 1 = read libcurl inside running containers
                                    (default 1; 0 to skip)
  HUNT_SINCE="2026-10-01"           how far back hunt reads the journal
  HUNT_LOGS="/srv/app/log/*.log"    extra log globs for hunt

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.