CVE-2026-92392
News and reports on Orbitaley
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
CVSS
- Base score
- 8.1
- Version
- 3.1
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.85 %
- Percentile among all scored CVEs
- 58
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Public exploits
Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
- Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub
⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.
Media coverage
Specialised security media that have cited this CVE:
- CISO Advisor · Curl corrige falha de RCE encontrada pela Anthropic (10/15/2026)
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access90 %
El vector CVSS AV:N/PR:N/UI:N indica explotación remota sin autenticación (T1190). La descripción solo cita un use-after-free por RST_STREAM, sin ejecución de comandos, DoS ni acceso a datos explícitos, así que no se asigna impacto.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-416
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-92392",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-92392",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-10-15T03:56:56.051034Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"affectedData": [
{
"vendor": "curl",
"product": "curl",
"versions": [
{
"status": "affected",
"version": "8.22.0",
"versionType": "semver",
"lessThanOrEqual": "8.22.0"
},
{
"status": "affected",
"version": "8.21.0",
"versionType": "semver",
"lessThanOrEqual": "8.21.0"
},
{
"status": "affected",
"version": "8.20.0",
"versionType": "semver",
"lessThanOrEqual": "8.20.0"
},
{
"status": "affected",
"version": "8.19.0",
"versionType": "semver",
"lessThanOrEqual": "8.19.0"
},
{
"status": "affected",
"version": "8.18.0",
"versionType": "semver",
"lessThanOrEqual": "8.18.0"
},
{
"status": "affected",
"version": "8.17.0",
"versionType": "semver",
"lessThanOrEqual": "8.17.0"
},
{
"status": "affected",
"version": "8.16.0",
"versionType": "semver",
"lessThanOrEqual": "8.16.0"
},
{
"status": "affected",
"version": "8.15.0",
"versionType": "semver",
"lessThanOrEqual": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1",
"versionType": "semver",
"lessThanOrEqual": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0",
"versionType": "semver",
"lessThanOrEqual": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0",
"versionType": "semver",
"lessThanOrEqual": "8.13.0"
},
{
"status": "affected",
"version": "8.12.1",
"versionType": "semver",
"lessThanOrEqual": "8.12.1"
},
{
"status": "affected",
"version": "8.12.0",
"versionType": "semver",
"lessThanOrEqual": "8.12.0"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-10-14T08:17:05.997",
"references": [
{
"url": "https://curl.se/docs/CVE-2026-92392.html",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://curl.se/docs/CVE-2026-92392.json",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://hackerone.com/reports/4030333",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/18/5",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/18/6",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hackerone.com/reports/4030333",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."
}
],
"lastModified": "2026-10-18T23:16:57.163",
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"
}