The curl project has released a security update addressing a high-severity vulnerability that could allow a malicious server to execute code on a computer uploading data over HTTP/2. The flaw affects both the curl command-line tool and libcurl, a widely used library that handles network transfers for numerous applications.
It affects curl versions 8.12.0 through 8.22.0 and was patched with the release of curl 8.23.0 on October 14, 2026. The project classified the issue as high severity, marking its first vulnerability to receive that rating since October 2023.
The issue was reported on September 15 by researchers at Anthropic, who used the company’s AI-assisted OSS Scanner to identify the weakness. A working proof-of-concept exploit also demonstrated that the flaw could lead to remote code execution under carefully controlled conditions.
How the HTTP/2 Vulnerability Works
The vulnerability is caused by a use-after-free memory error in curl’s handling of HTTP/2 uploads. This can occur when software attempts to access memory that has already been released, potentially allowing an attacker to manipulate data or alter program execution. A malicious server can trigger the vulnerability by manipulating an ongoing HTTP/2 upload. The server temporarily pauses the transfer, sends part of a response, and resets the connection’s active stream.
Although curl attempts to handle the interruption, an internal reference to the completed transfer can remain active after its associated memory has been freed. Subsequent communication with the server may cause curl to reuse that memory, creating an opportunity for malicious data to influence program execution.
Researchers demonstrated that this behavior could be exploited to overwrite a function pointer and execute attacker-controlled code on the client system.
Successful exploitation, however, requires several specific conditions. The user needs to upload approximately 135 KB of data to a malicious server with a certificate accepted by the client. The attacker must also know details about the target’s curl version, processor architecture, memory allocator, precise timing, memory allocation patterns and other system components., making the attack difficult to reproduce outside a controlled environment. According to the curl project, an attempted exploit would be more likely to crash the affected application than achieve code execution.
Affected Versions and Security Fixes
The vulnerability affects curl and libcurl versions 8.12.0 through 8.22.0, released between February 2025 and October 2026. Systems using versions earlier than 8.12.0 are not affected by this particular issue.
The curl project recommends upgrading to version 8.23.0, which includes the security correction. Fixes are also available for several maintained branches, including versions 8.14.3, 8.16.2, and 8.20.2.
The patch corrects how curl handles pending upload data and releases references to completed transfers, preventing the use-after-free condition.
For systems that cannot be updated immediately, the project’s advisory recommends avoiding HTTP/2 connections as a temporary workaround. Administrators can configure curl to use HTTP/1.1, although applications relying on libcurl may require separate configuration changes.
The vulnerability was one of 24 security issues addressed in curl 8.23.0, with the remaining 23 classified as low severity. The project shortened its usual release cycle by two weeks to deliver the updates sooner.
Leave a Reply