(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl | curl | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Debian DSA |
DSA-6558-1 | curl security update |
 Ubuntu USN |
USN-8927-1 | curl vulnerabilities |
Wed, 14 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 |
Wed, 14 Oct 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object. | |
| Title | HTTP/2 upload Use-After-Free | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-10-14T07:46:15.160Z
Reserved: 2026-09-16T08:12:53.407Z
Link: CVE-2026-92392
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T08:17:05.997
Modified: 2026-10-14T08:17:05.997
Link: CVE-2026-92392
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-14T15:30:03Z