TLDR Tech / Practical
Critical HTTP/2 Flaw in curl Addressed
A critical vulnerability in curl version 8.23.0, identified as CVE-2026-92392, has been resolved. This HTTP/2 upload flaw involved a use-after-free issue with a dangling pointer. Under specific conditions when shutting down a multi handle, it could potentially allow remote code execution by overwriting data. Anthropic's Luna Tong discovered the bug, though successful exploitation is considered highly improbable due to strict requirements.
Read the full story