CVE-2026-92390

A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system.

This vulnerability is rated as Low severity because it is confined to the curl command-line utility, leaves the underlying libcurl library unaffected, and requires explicit use of non-default command arguments against an untrusted remote server. In typical Red Hat enterprise deployments, core services and applications integrate with libcurl for HTTP transfers rather than invoking the standalone CLI, significantly limiting exposure. Exploitation depends on user interaction where an administrator or script actively downloads files using the remote header naming option while handling specific server response codes like 103 Early Hints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.