#curl

A curl bug let a hostile server hijack the uploader, and someone proved it

CVE-2026-92392 turns a memory bug in curl's HTTP/2 upload code into client-side code execution. The fix landed in curl 8.23.0 on October 14.