{"id":"CVE-2026-92392","title":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.","summary":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.","severity":"none","published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T08:17:05.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","references":[{"url":"https://curl.se/docs/CVE-2026-92392.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2026-92392.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/4030333","label":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"tags":["nvd"],"ingestedAt":"2026-10-14T08:23:04.345Z","slug":"CVE-2026-92392","body":"## Overview\n\nDuring an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}