---
id: CVE-2026-92390
title: '-J no-clobber guarantee bypassed with 103 early hints'
summary: |-
  When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
  documented anti-clobbering protection if an intermediate 103 Early Hints
  response precedes the final HTTP response, or if an `ETag` header is processed
  before `C…
severity: none
cwe:
  - CWE-73
vendor: curl
product: curl
affected:
  - curl >= 8.22.0 <= 8.22.0
  - curl >= 8.21.0 <= 8.21.0
  - curl >= 8.20.0 <= 8.20.0
  - curl >= 8.19.0 <= 8.19.0
  - curl >= 8.18.0 <= 8.18.0
  - curl >= 8.17.0 <= 8.17.0
  - curl >= 8.16.0 <= 8.16.0
  - curl >= 8.15.0 <= 8.15.0
  - curl >= 8.14.1 <= 8.14.1
  - curl >= 8.14.0 <= 8.14.0
  - curl >= 8.13.0 <= 8.13.0
  - curl >= 8.12.1 <= 8.12.1
  - curl >= 8.12.0 <= 8.12.0
  - curl >= 8.11.1 <= 8.11.1
  - curl >= 8.11.0 <= 8.11.0
  - curl >= 8.10.1 <= 8.10.1
  - curl >= 8.10.0 <= 8.10.0
  - curl >= 8.9.1 <= 8.9.1
  - curl >= 8.9.0 <= 8.9.0
  - curl >= 8.8.0 <= 8.8.0
  - curl >= 8.7.1 <= 8.7.1
  - curl >= 8.7.0 <= 8.7.0
  - curl >= 8.6.0 <= 8.6.0
  - curl >= 8.5.0 <= 8.5.0
  - curl >= 8.4.0 <= 8.4.0
  - curl >= 8.3.0 <= 8.3.0
  - curl >= 8.2.1 <= 8.2.1
  - curl >= 8.2.0 <= 8.2.0
  - curl >= 8.1.2 <= 8.1.2
  - curl >= 8.1.1 <= 8.1.1
  - curl >= 8.1.0 <= 8.1.0
  - curl >= 8.0.1 <= 8.0.1
  - curl >= 8.0.0 <= 8.0.0
  - curl >= 7.88.1 <= 7.88.1
  - curl >= 7.88.0 <= 7.88.0
  - curl >= 7.87.0 <= 7.87.0
  - curl >= 7.86.0 <= 7.86.0
  - curl >= 7.85.0 <= 7.85.0
  - curl >= 7.84.0 <= 7.84.0
  - curl >= 7.83.1 <= 7.83.1
  - curl >= 7.83.0 <= 7.83.0
  - curl >= 7.82.0 <= 7.82.0
  - curl >= 7.81.0 <= 7.81.0
  - curl >= 7.80.0 <= 7.80.0
  - curl >= 7.79.1 <= 7.79.1
  - curl >= 7.79.0 <= 7.79.0
  - curl >= 7.78.0 <= 7.78.0
  - curl >= 7.77.0 <= 7.77.0
  - curl >= 7.76.1 <= 7.76.1
  - curl >= 7.76.0 <= 7.76.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:23:08.900Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92390'
references:
  - url: 'https://curl.se/docs/CVE-2026-92390.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-92390.html'
    label: www
  - url: 'https://hackerone.com/reports/4023192'
    label: issue
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.282Z'
---

## Overview

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an `ETag` header is processed
before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
`Content-Disposition` header despite the presence of the `-J` non-overwrite
constraint.

## Affected

- `curl >= 8.22.0 <= 8.22.0`
- `curl >= 8.21.0 <= 8.21.0`
- `curl >= 8.20.0 <= 8.20.0`
- `curl >= 8.19.0 <= 8.19.0`
- `curl >= 8.18.0 <= 8.18.0`
- `curl >= 8.17.0 <= 8.17.0`
- `curl >= 8.16.0 <= 8.16.0`
- `curl >= 8.15.0 <= 8.15.0`
- `curl >= 8.14.1 <= 8.14.1`
- `curl >= 8.14.0 <= 8.14.0`
- `curl >= 8.13.0 <= 8.13.0`
- `curl >= 8.12.1 <= 8.12.1`
- `curl >= 8.12.0 <= 8.12.0`
- `curl >= 8.11.1 <= 8.11.1`
- `curl >= 8.11.0 <= 8.11.0`
- `curl >= 8.10.1 <= 8.10.1`
- `curl >= 8.10.0 <= 8.10.0`
- `curl >= 8.9.1 <= 8.9.1`
- `curl >= 8.9.0 <= 8.9.0`
- `curl >= 8.8.0 <= 8.8.0`
- `curl >= 8.7.1 <= 8.7.1`
- `curl >= 8.7.0 <= 8.7.0`
- `curl >= 8.6.0 <= 8.6.0`
- `curl >= 8.5.0 <= 8.5.0`
- `curl >= 8.4.0 <= 8.4.0`
- `curl >= 8.3.0 <= 8.3.0`
- `curl >= 8.2.1 <= 8.2.1`
- `curl >= 8.2.0 <= 8.2.0`
- `curl >= 8.1.2 <= 8.1.2`
- `curl >= 8.1.1 <= 8.1.1`
- `curl >= 8.1.0 <= 8.1.0`
- `curl >= 8.0.1 <= 8.0.1`
- `curl >= 8.0.0 <= 8.0.0`
- `curl >= 7.88.1 <= 7.88.1`
- `curl >= 7.88.0 <= 7.88.0`
- `curl >= 7.87.0 <= 7.87.0`
- `curl >= 7.86.0 <= 7.86.0`
- `curl >= 7.85.0 <= 7.85.0`
- `curl >= 7.84.0 <= 7.84.0`
- `curl >= 7.83.1 <= 7.83.1`
- `curl >= 7.83.0 <= 7.83.0`
- `curl >= 7.82.0 <= 7.82.0`
- `curl >= 7.81.0 <= 7.81.0`
- `curl >= 7.80.0 <= 7.80.0`
- `curl >= 7.79.1 <= 7.79.1`
- `curl >= 7.79.0 <= 7.79.0`
- `curl >= 7.78.0 <= 7.78.0`
- `curl >= 7.77.0 <= 7.77.0`
- `curl >= 7.76.1 <= 7.76.1`
- `curl >= 7.76.0 <= 7.76.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.