CVE-2026-92391

A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS).

This vulnerability is rated as Low severity because triggering the crash requires an application to construct thousands of nested MIME structures via libcurl's API, an atypical pattern not encountered in normal deployments. Furthermore, the curl command-line utility is not affected, restricting the blast radius strictly to custom or third-party applications invoking these specific functions. The resulting stack exhaustion leads only to a denial of service through process termination without compromising confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.