Curl HTTP/2 upload Use-After-Free
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-92392, Summary: During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object. See also: https://curl.se/docs/CVE-2026-92392.html
EPSS 0.00 CVE-2026-92392 curl FI