curl 8.23.0: one HIGH flaw, 24 advisories, and the package revision our fleet still lacks

On 14 October 2026 the curl project released version 8.23.0, four weeks ahead of its own schedule. A report about one flaw was serious enough to pull the date forward. The same day the project published 24 advisories. 21 are fixed in 8.23.0, three were already fixed in 8.22.0 and only became public now. One of the 24 is rated HIGH, the other 23 LOW. On 15 October we read our own estate: 19 hosts with curl and 23 containers with curl, plus the package states of Debian, Ubuntu and Alpine. Result: three hosts and twelve containers are exactly one package revision behind, and eight Alpine hosts have no update to install yet.

curl ran on 19 of our hosts and sat in 23 of our containers. (Quelle: Wikimedia Commons, file Curl-logo.svg, licence MIT, curl contributors)

What CVE-2026-92392 does and what it needs

The flaw sits in the HTTP/2 upload path. A server throttles the sender by setting the HTTP/2 window to zero, sends part of a response and resets the stream with RST_STREAM without closing the connection. curl tears the transfer down cleanly but leaves a pointer to the already freed easy handle. When the multi handle is cleaned up the library does not notice, loads server data into the freed structure and finally calls a function pointer that exactly this data has overwritten. The result is server-controlled code on the machine that did the upload.

For that to become code execution, several conditions have to hold at once, according to Stenberg's description. The upload must go to a server with a valid certificate. The upload size must hit roughly 135 KB. The allocation pattern differs between distributions, libc versions, CA bundles and applications, and the attacker has to match it for the target. The payload storage area is small, around 23 bytes. Daniel Stenberg writes that the curl team considers this combination extremely difficult to reach in the wild, which is why the flaw is HIGH and not CRITICAL.

The advisory credits Luna with Claude from Anthropic as reporter, reported on 15 September 2026 and fixed by Stefan Eissing after 29 days. It offers three remedies: upgrade to 8.23.0, apply the patch yourself, or avoid HTTP/2.

Two numbers from the project's advisory table put this in context. Since 2021 exactly three entries carry the level HIGH: this one, CVE-2021-22901 and CVE-2023-38545. And 14 of the 24 titles from 14 October mention connection reuse, origin address, credentials, cookies or HSTS state in their wording. State carried over from an earlier transfer on a reused connection remains the main source of curl reports.

Five steps in this order. Step 2 decides, because version 8.14.1 appears in a patched and an unpatched package revision alike. (Quelle: Our own procedure for the fleet check, 15 Oct 2026)

Who found the flaws

The HIGH case was reported by "Luna with Claude" of Anthropic, on 15 September 2026 according to the advisory. For the sheer number of advisories the project offers a second explanation. On 14 October Daniel Stenberg wrote that the company Aisle had spent the past year pointing AI-powered tooling, together with its own engineers, at curl's source, with the result of "no less than thirty-five published curl vulnerabilities and CVE IDs". It is the fifth external audit, and the report is published on the curl site. Stenberg calls the collaboration entirely positive and says Aisle has found more curl CVEs than any other group or individual.

Aisle sizes its own share in its blog of the same day. By that account 18 of the 24 findings in 8.23.0 come from Aisle, and six more were in 8.22.0. Aisle sorts the 18 like this: eight concern credentials or identity, four persistent cookie and HSTS state, four protocol and command-line edge cases, two memory safety or availability. These are vendor statements. The Aisle page carries no severity ratings and does not mention the HTTP/2 flaw, so the HIGH report stays attributed to the reporter named in the advisory.

Aisle statement of 14 Oct 2026, 18 findings in 8.23.0. The total of 18 is Aisle's figure and the page gives no severities. The curl project lists 24 advisories for 8.23.0 in total. (Quelle: Aisle blog, 14 Oct 2026)

The sources need reconciling here. The figure "22" circulates in some reports and comes from Stenberg's post of 7 October, which announced 22 pending reports. The project's advisory table lists 24 entries for 14 October. Amazon Linux lists the HIGH flaw with CVSS 8.1 in its database. The curl project assigns no CVSS number itself, only the levels Low, Medium, High and Critical.

We looked for forum discussion and found little. Hacker News has several submissions of Stenberg's posts, the largest with 8 points and no comment (thread). The technical debate runs on the oss-sec security list.

What the distributors shipped on release day

Debian issued DSA-6558-1 for trixie on 14 October and fixes curl there with 8.14.1-2+deb13u7. The four CVEs in that notice are CVE-2026-8286, CVE-2026-8924, CVE-2026-8927 and the new HIGH case. Ubuntu sent two notices the same day. For 26.04 LTS, USN-8927-1 brings 8.18.0-1ubuntu2.8. For 24.04 and older, USN-8932-1 brings 8.5.0-2ubuntu10.16 for noble. On the CVE page for CVE-2026-92392, 24.04 and 22.04 are explicitly marked Not affected, because their curl at 8.5.0 predates the affected code stage 8.12.0.

For Alpine we looked at two Alpine 3.23 hosts on 15 October. apk policy curl there reports only 8.22.0-r0 in the v3.23/main repo, which is the last affected release, and the secdb for 3.23 lists none of the new CVEs. As of our measurement no update for these advisories exists for Alpine 3.23, so anyone running Alpine is tied to that branch.

CERT-Bund followed on 14 October at 14:09 CEST with WID-SEC-2026-3904, rated high, citing code execution, bypass of security measures, information disclosure, data manipulation and denial of service. We found no CISA KEV entry and no exploitation report.

A look at our own fleet

Read on 15 October 2026 via ssh and curl --version, 19 of 29 hosts queried. 16 of them fall into the range 8.12.0 to 8.22.0 affected by the HIGH case. One more Alpine host has no curl installed, and nine hosts could not be reached from this machine. (Quelle: Our own measurement, 15 Oct 2026)

Split by package revision, measured on 15 October: four hosts already have the distributor update, three Ubuntu systems on 8.18.0-1ubuntu2.8 and one Debian 13 host on 8.14.1-2+deb13u7. Three hosts are one measurable revision behind: two Ubuntu 26.04 systems on 8.18.0-1ubuntu2.7 and our pbs3 on 8.14.1-2+deb13u5. Two Ubuntu 24.04 systems run 8.5.0-2ubuntu10.15, a state before the 8.5.0-2ubuntu10.16 package from USN-8932-1, although the HIGH flaw does not apply there by Ubuntu's own status. Eight Alpine 3.23 hosts sit on 8.22.0-r0 and, as measured above, have no update in the repo. One further 26.04 host shows curl 8.18.0 in the binary but no dpkg entry, so we cannot make a package statement about it.

For containers the second line of curl --version tells the truth, because on Debian images it carries the patch level. In 18 of the 23 containers we counted it is readable and reports 8.14.1-2+deb13u5 twelve times, 7.88.1-10+deb12u15 four times and the already fixed 8.14.1-2+deb13u7 twice. The other five containers are Alpine builds without any patch-level marker, four of them on curl 8.22.0. They are stuck twice: no distributor patch level to read, and, as measured above, no update in the Alpine branch yet. Updating the host changes none of these files. They need a new build from the updated base image.

Counted on 15 Oct 2026 in 18 of 23 containers with curl, second line of curl --version. The other five report no Debian patch level; they are Alpine builds. (Quelle: Our own measurement, 15 Oct 2026)

The end of SMB came in two steps

The 8.23.0 changes list "SMB: drop support", with a note in DEPRECATE.md. Anyone surprised by this missed March. On 22 March 2026 Daniel Stenberg explained that curl only ever spoke SMB version 1, that this protocol uses NTLM to log in, and that from 8.20.0 both are only built in on explicit request. The same text lists seven recorded vulnerabilities in NTLM-dependent code and notes that Microsoft has deprecated NTLM itself. The October removal is the second step on the same path, announced seven months earlier.

You can check this in the feature block of curl -V. Of five host builds we checked, four still offer smb and NTLM. The Alpine build on our blog box does not, and neither does the edge image of the transport line. In the script directories, cron jobs and Hermes scripts on .180.2 and on the transport branch on .200.11, grep found not a single call with smb://. For us the removal changes nothing. Anyone who still has such calls in scripts has been speaking SMBv1 for years.

What is open, in which order

Three host updates are open for the next maintenance window: two Ubuntu systems to 8.18.0-1ubuntu2.8 and pbs3 to 8.14.1-2+deb13u7. For the Alpine hosts there is nothing to install as of 15 October, so the v3.23 branch has to be watched until a package appears. The container images on deb13u5 need a new build once the base image is updated, sensibly in order of exposure: edge and proxy first, then the MCP services on the internal network. In this run we measured and noted. We installed nothing.

Two checks are worth taking from this run into any estate. First: find out whether your containers ship a curl at all, and on Debian images read the second line, because that is where the revision is. Second: count the Alpine branches too, because a distributor with no package the day after release only moves the problem by a few days.

How we measured

We measured on 15 October 2026 over ssh on the hosts reachable from the workstation, 19 of 29 queried. On each host we read curl -V for version and protocols and dpkg -l curl or apk policy curl for the package revision. In containers we ran curl --version through docker exec, and on Debian images the second line holds the patch level. 23 containers had a curl, and in 18 the line was readable. The distributions are in the two charts and the raw data is with us. No measurement could change production, and nothing was installed.