What is CVE-2026-92392?

CVE-2026-92392 is a vulnerability in Curl, classified under CWE-416 USE AFTER FREE. Published 2026-10-14.

Is CVE-2026-92392 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Curl

CVE-2026-92392

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Published 2026-10-14.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Curl

Public proof-of-concept exploits

ashu7ank/CVE-2026-92392

References

2499f714-1537-4658-8207-48ae4bb9eae9
2499f714-1537-4658-8207-48ae4bb9eae9
2499f714-1537-4658-8207-48ae4bb9eae9

Frequently asked questions

What is CVE-2026-92392?: CVE-2026-92392 is a vulnerability in Curl, classified under CWE-416 USE AFTER FREE. Published 2026-10-14.
Is CVE-2026-92392 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.