CVE-2026-92392 - HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
Publicatum: Oct 14, 2026 08:17
Ultima Mutatio: Oct 15, 2026 11:18