TLDR Tech / News
curl fixes critical HTTP/2 flaw allowing code execution
The curl project has addressed a critical vulnerability (CVE-2026-92392) in curl and libcurl versions 8.12.0 through 8.22.0. This flaw, discovered by Luna Tong of Anthropic, could enable a malicious server to cause memory corruption and execute code during HTTP/2 uploads under specific reset conditions. Version 8.23.0 has been released to fix the issue, and users unable to update are advised to disable HTTP/2 support.
Read the full story