CVE-2026-92392curl Use-After-Free
HTTP/2 upload Use-After-Free
Published Oct 14, 2026 · Updated Oct 18, 2026 · Also known as CURL-CVE-2026-92392, EUVD-2026-100915, GHSA-7jvw-75gf-2h34
Key Facts
Patch immediately- CVE-2026-92392 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Azl3 Mysql 8.0.46-2 (Microsoft), Azl3 Rust 1.75.0-31 (Microsoft), Azl3 Rust 1.96.1-2 (Microsoft) and 8 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 0.7% probability of exploitation in the next 30 days.
- Fixed versions are available, including curl 8.14.1-2+deb13u7, curl 8.18.0-1ubuntu2.8, curl 8.23.0-1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
0.7%
Exploit maturity
Proof of concept
ATLAS score
44/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryRHSA-2026:80349
- advisoryRHSA-2026:82895
- advisoryRelease Notes
- advisoryUSN-8927-1
Description
During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object.
Affected Products
16 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Azl3 Mysql 8.0.46-2Microsoft | See advisory | n/a |
| Azl3 Rust 1.75.0-31Microsoft | See advisory | n/a |
| Azl3 Rust 1.96.1-2Microsoft | See advisory | n/a |
| curldebian | >= 8.22.0 | 0 |
| libcurl3t64-gnutlsubuntu | See advisory | 8.18.0-1ubuntu2.8 |
Patched Releases
curl
8.14.1-2+deb13u7, 8.18.0-1ubuntu2.8, 8.23.0-1
curl-main
8.23.0-0.1.hum1
libcurl3t64-gnutls
8.18.0-1ubuntu2.8
libcurl4-doc
8.18.0-1ubuntu2.8
libcurl4-gnutls-dev
8.18.0-1ubuntu2.8
libcurl4-openssl-dev
8.18.0-1ubuntu2.8
libcurl4t64
8.18.0-1ubuntu2.8
rust-main
1.99.0-1.hum1
Timeline
Publicly disclosed
Oct 14, 2026
Last updated
Oct 18, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryRHSA-2026:80349
- advisoryRHSA-2026:82895
- advisoryRelease Notes
- advisoryUSN-8927-1
- otherwww
FAQ
Common Questions.
During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object.
Affected: Azl3 Mysql 8.0.46-2 (Microsoft); Azl3 Rust 1.75.0-31 (Microsoft); Azl3 Rust 1.96.1-2 (Microsoft), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including curl 8.14.1-2+deb13u7, curl 8.18.0-1ubuntu2.8, curl 8.23.0-1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-92392 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo