Loading story…
curl 8.23.0 fixes 24 vulnerabilities, including the high-severity HTTP/2 upload use-after-free flaw CVE-2026-92392 and 23 low-severity issues. A malicious HTTP/2 server can manipulate an upload and stream teardown, leaving libcurl with a pointer to a freed transfer handle; memory-address leakage and attacker-controlled data can then enable a function-pointer overwrite and remote code execution. Exploitation requires tightly constrained upload sizes, memory-allocation behavior and platform knowledge, and maintainers consider a crash much more likely than successful code execution. Luna Tong at Anthropic reported the flaw using OSS Scanner, prompting an accelerated release while the project continues replacing internal handle pointers with transfer identifiers and expanding testing.
The release also removes SMB and SMBS support from curl and libcurl, following curl 8.20.0's decision to make NTLM and SMB support opt-in at build time. curl's SMB implementation supported only SMBv1 and depended on NTLM, whose connection-level authentication added complexity and contributed to at least seven historical curl vulnerabilities. Version 8.23.0 additionally includes 281 bug fixes and deprecates CURL_GLOBAL_WIN32 in favor of CURL_GLOBAL_WINSOCK. Organizations should prioritize updating deployed curl and embedded libcurl components, especially clients uploading to untrusted HTTP/2 servers, and identify workflows requiring replacement SMB functionality before upgrading.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
curl published the advisory for low-severity CVE-2026-87864, which allows extra bytes introduced by CURLOPT_CRLF conversion during IMAP uploads to be interpreted as commands within an authenticated IMAP session. The flaw affects versions 7.30.0 through 8.21.0 and had already been fixed in curl 8.22.0.
The reporter's HackerOne write-up for CVE-2026-92392 became public, including a malicious server script and a Docker-based code-execution reproducer. Successful exploitation requires precise knowledge of the target environment and tightly controlled timing; no attacks exploiting the flaw were reported.
Stenberg explained how a malicious HTTP/2 server could trigger a dangling transfer-handle pointer, leak client memory addresses, and overwrite a function pointer to achieve code execution. He detailed restrictive upload and allocation requirements, noting that attempted exploitation would most often cause a crash.
Luna Tong at Anthropic reported CVE-2026-92392 using OSS Scanner, and the curl security team confirmed the vulnerability within hours of its September 15 submission. The use-after-free affects HTTP/2 uploads and can enable remote code execution under tightly constrained conditions.
Stenberg implemented curl's NTLM support using publicly available, reverse-engineered protocol documentation. NTLM's connection-based authentication later required special handling and contributed to security problems in curl.
Fixes for CVE-2026-92392 are also available in curl 8.14.3, 8.16.2, and 8.20.2. Distribution fixes include Ubuntu package 8.18.0-1ubuntu2.8 and Debian Trixie package 8.14.1-2+deb13u7, whose base versions otherwise fall within the affected upstream range.
curl released version 8.23.0 with fixes for the high-severity CVE-2026-92392 and 23 low-severity vulnerabilities. The release also removed SMB and SMBS support from curl and libcurl and included 281 bug fixes.
The curl team shortened its pending release cycle from eight weeks to six weeks after confirming the vulnerability. The accelerated release also incorporated fixes for other vulnerabilities and general bugs.
Stenberg announced that NTLM and SMB support would require explicit build-time enablement starting with curl 8.20.0. He described the change as a step toward possible removal, citing NTLM's security and architectural problems and curl's support for only SMBv1.
Microsoft deprecated NTLM, the proprietary authentication protocol used by curl's SMBv1 implementation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecurl.se
Open sourceexplore.alas.aws.amazon.com
Open sourcedaniel.haxx.se
Open sourcesecurity.alpinelinux.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The curl project released **curl/libcurl 8.22.0**, its 276th release, with 302 bug fixes and ten security advisories: nine affecting curl or libcurl and one affecting `wcurl`. The fixes address authentication bypasses, use-after-free conditions, certificate-validation and certificate-pinning bypasses, unsafe connection reuse, and cookie-policy bypasses. The release also adds experimental RFC 9421 HTTP Message Signatures support, prevents NTLM fallback during SPNEGO negotiation, adds Apple-platform support, and removes TLS-SRP support. One advisory, **CVE-2026-80256**, is a medium-severity Windows path-traversal flaw in `wcurl`. Percent-encoded backslashes in a server-influenced output filename can be decoded, allowing a file to be written outside the directory selected by the user. Affected versions include `wcurl` bundled with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05; remediation is to upgrade to curl 8.22.0 or wcurl 2026.08.30, apply the patch, explicitly set output filenames, or disable output-filename percent decoding.
Sep 4, 2026
The curl project released **curl/libcurl 8.20.0** with fixes for several disclosed vulnerabilities that could leak credentials, cookies, or authenticated session state across requests, redirects, proxies, and reused connections. The most broadly exposed issue, **`CVE-2026-6253`**, allows proxy credentials to be forwarded to a different proxy during cross-scheme redirects when separate proxies are configured; it affects **curl and libcurl** from `7.14.1` through `8.19.0`. curl also fixed **`CVE-2026-5545`**, where HTTP(S) connections authenticated with **Negotiate** could be wrongly reused for a different user, potentially sending requests over a connection still authenticated as the first user; that flaw affects versions `7.10.6` through `8.19.0` and also impacts the command-line tool. Additional flaws primarily affect **libcurl** handle and connection reuse. **`CVE-2026-7168`** can leak **Digest proxy authentication state** when the same handle is reused across different HTTP proxies, **`CVE-2026-6429`** can expose **`.netrc` credentials** during HTTP redirects over a reused proxied connection, and **`CVE-2026-6276`** can send cookies for one host to another after reuse of an easy handle with a removed custom `Host:` header. The affected ranges span from `7.12.0` to `8.19.0` depending on the bug, and curl advised users to **upgrade to 8.20.0**, apply the published patches, or avoid risky patterns such as proxy credential use, custom `Host:` headers, `.netrc` with proxied cleartext HTTP, HTTP Negotiate, and handle reuse when switching proxies.
Jun 29, 2026
curl 8.21.0 fixes multiple security and correctness issues caused by trailing-dot hostname handling, including **CVE-2026-8924**, a cookie parsing flaw that lets a malicious HTTP server set "super cookies" for public suffix domains. By abusing hostnames such as `example.co.uk.`, an attacker could bypass curl's Public Suffix List validation and cause curl to later send attacker-set cookies to unrelated third-party domains. The vulnerability affects curl versions `7.46.0` through `8.20.0`; builds without PSL support are not protected against this class of issue, and the project recommends upgrading to `8.21.0`, applying the patch, or avoiding trailing dots in hostnames. The release also addresses two additional trailing-dot bugs: curl could treat an IPv4 literal with a trailing dot as a hostname rather than an IP address, potentially allowing an incorrect wildcard TLS certificate match, and hostnames with double trailing dots could trigger internal logic errors including HSTS confusion. curl now bans double-trailing-dot names, and the fixes were coordinated through a June disclosure process after the cookie issue was reported by vegagent on HackerOne and patched by Daniel Stenberg.
Jul 12, 2026