A high-severity use-after-free vulnerability in curl and libcurl HTTP/2 uploads allows malicious servers to corrupt client memory.
Affecting versions 8.12.0 through 8.22.0, the flaw was fixed in version 8.23.0.
The issue affects versions 8.12.0 through 8.22.0. The curl development team was notified of the issue on September 15, 2026, and released the fixed version 8.23.0 on October 14, 2026.
How can the attack happen?
The vulnerability occurs when sending a file of approximately 135 KB in size over HTTP/2 to a server controlled by a fraudster and with a valid certificate. In this case, the server can trick the system into reusing memory segments that have already been closed.
Researchers were able to show that this memory error could be turned into command execution. However, there are currently no reports of the problem being used in real attacks.
READ ALSO
CISA requests immediate update on Ivanti systems due to attacks
What you have to do
The main solution is to immediately upgrade to version 8.23.0 or other fixed versions released in parallel.
If immediate updating is not possible, the developers recommend avoiding using the HTTP/2 protocol and forcing the program to use the older HTTP/1.1 version.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)