CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS).

Red Hat has rated this flaw as having an Important severity because a malicious HTTP/2 server can remotely trigger memory corruption during data uploads, potentially leading to client application crashes or arbitrary code execution. While remote code execution has been demonstrated, exploitation requires strict prerequisites such as exact heap layout predictability and precise server-controlled timing, which limits broad automated exploitability. Earlier versions of Red Hat Enterprise Linux, including RHEL 8 and 9, are not vulnerable as they ship curl builds preceding the introduction of the flawed logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable HTTP/2 in curl. For the curl CLI, use the --http1.1 flag. For applications using libcurl, set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. This vulnerability is only exploitable over HTTP/2 connections; HTTP/1.1 connections are not affected. Note that applications which depend on HTTP/2-specific features, such as gRPC, will not function with this workaround.