On October 14, 2026, the curl project released version 8.23.0 and disclosed a fix for CVE-2026-92392. The project rates its severity High. Its reporting credit reads “Luna with Claude, Anthropic”; that is the project’s attribution, not evidence that AI found the issue without human involvement.
Who should check
Small-business owners with custom websites, integrations or file-transfer applications can pass the advisory to their developer or software provider. The project notes that many applications use libcurl without advertising it. Having such applications does not itself establish that your system is vulnerable.
What changed
The flaw affects the client uploading data to a server over HTTP/2: a particular server response can trigger a use-after-free memory error. The project reports that a malicious server can exploit it for remote code execution under specific technical conditions. This describes technical exploitability; the sources checked do not establish real-world attacks.
The project lists 8.12.0 through 8.22.0 as affected, with exceptions for patched maintained branches. Fixes are available in 8.23.0, and from 8.20.2 in the 8.20.x branch, 8.16.2 in the 8.16.x branch and 8.14.3 in the 8.14.x branch. Simply comparing a version number with 8.23.0 is therefore insufficient: establish the branch and whether the fix is included.
A practical next step
Our editorial recommendation is to send your provider the CVE identifier and ask whether your application uses libcurl, which version it includes and whether it contains the fix, including a provider backport to an older version. Arrange a supported update and check normal integrations afterwards. Updating a separate curl command-line installation does not establish that every application has been updated.
The official remedies are updating the affected curl/libcurl, applying the patch or avoiding HTTP/2. Leave that last option to the technical owner because changing a protocol can affect workflows. We have not tested readers’ applications or servers.
