curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A use-after-free flaw in how curl handles HTTP/2 uploads (CVE-2026-92392) lets a malicious server corrupt the memory of a client uploading to it, and the reporting researcher demonstrated code execution on the client machine, The Hacker News reports. The flaw affects curl and libcurl 8.12.0 through 8.22.0 and is fixed in curl 8.23.0, released early on October 14.