curl Fixes a Record 24 Vulnerabilities in One Release, Including a High-Severity Bug Reported by Anthropic

The curl project released version 8.23.0 on Wednesday, October 14, with fixes for 24 vulnerabilities, more than it has ever published at once. By our count of curl’s own vulnerability data, the previous record was 18, set with 8.21.0 on June 24, and no full year before 2026 produced more than 24. One of the 24 is rated High: CVE-2026-92392, a use-after-free in the HTTP/2 upload path of curl and libcurl 8.12.0 through 8.22.0. It is the first High curl has published in just over three years, since CVE-2023-38545 on October 11, 2023.

The advisory credits the High to “Luna with Claude, Anthropic.” Daniel Stenberg, curl’s founder and lead developer, wrote that it was “found and reported by Luna Tong at Anthropic using their new OSS Scanner” and added: “Presumably this involves their AI models.” The other 23 are all rated Low, and 18 of the 24 come from an AI-assisted audit by the security company Aisle. When we covered OSS Scanner’s launch on October 9, none of the 215 entries in curl’s vulnerability list credited Anthropic. Two of the 239 entries now do.

The High-severity bug

According to the advisory, curl mishandles an HTTP/2 RST_STREAM frame that a server sends during an upload, with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM, and then uses a freed struct Curl_easy, the object curl keeps for each transfer. Both the command-line tool and libcurl are affected, and the advisory reminds readers that “libcurl is used by many applications, but not always advertised as such!” The affected range begins at 8.12.0, released on February 5, 2025, so the flaw shipped in releases for 616 days before the fix.

curl says the flaw “has been proven to be possible to convert into a Remote Code Execution if a set of specific criteria are met by the malicious server.” The criteria it lists are demanding: the exact curl build and architecture, a compatible libc allocator and heap layout, specific nghttp2 and OpenSSL behavior, a pinned CA bundle, two parallel transfers kept in step, and a payload that currently fits only about 23 bytes. Stenberg adds that the victim has to choose to upload roughly 135 KB to a malicious server whose certificate is valid. He says the project deems it “extremely difficult to meet these requirements in the wild,” which is why the flaw is rated High and not Critical. “The most likely outcome of an attempted attack is rather just a crash,” he writes. “We estimate that the chance for a successful attack is slim.”

The advisory classes the bug as “a C mistake (likely to have been avoided had we not been using C).” Stenberg’s answer to the obvious follow-up is blunt: “We do not rewrite curl.” He calls a port to another language “a monstrous undertaking” and says the project has been reducing the number of internal pointers to handles that must be correct, storing transfer identifiers that are looked up on demand instead, which he describes as a tiny bit slower but more foolproof against logic mistakes.

curl does not publish CVSS scores because, as Stenberg wrote on October 7, “we basically don’t believe in CVSS scoring.” Ubuntu’s security team gave this bug a CVSS 3.1 score of 8.1 and High priority. The NVD record, published October 14, was still marked Received and carried no score when we checked.

How to tell whether your curl is exposed

The bug lives in HTTP/2 handling, so two things matter: the version, and whether the build can speak HTTP/2 at all. Run curl --version. The first line carries the curl and libcurl versions, and curl’s man page says the Features line lists HTTP2 when HTTP/2 support is built in. These are the first and last lines of what Git for Windows’ curl printed on the Windows 11 machine we use for these checks:

curl 8.21.0 (x86_64-w64-mingw32) libcurl/8.21.0 Schannel zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 WinLDAP
Features: alt-svc AsynchDNS brotli HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd

Both curl builds on that machine, Git for Windows’ copy and C:\Windows\System32\curl.exe, report 8.21.0, which is inside the affected range. Neither lists HTTP2 on its Features line or nghttp2 in its library list. On our reading that means the HTTP/2 code is not built in and this bug is out of reach for them, though we did not try to trigger it. A version string also cannot tell you whether a distribution has backported the fix: Ubuntu 26.04’s fixed package is still labeled curl 8.18.0, and Debian 13’s is still 8.14.1. Check your vendor’s notice, not just the number.

Stenberg points readers to the original report for “the full reproducible Docker image,” so the technical details are public and patching should not wait for a sign of attacks. CVE-2026-92392 is not in CISA’s Known Exploited Vulnerabilities catalog, and none of the sources we read reports exploitation.

The other 23 fixes

curl rates all 23 Low, using its own four labels (Low, Medium, High, Critical) instead of CVSS. Seventeen affect both the tool and libcurl, four only libcurl and two only the command-line tool. Most follow one pattern: state that should have been discarded or revalidated survives a redirect, a proxy hop or a reused connection. Each has its own advisory page on curl.se, and curl’s security page lists them all.

Upgraders should also know that 8.23.0 removes SMB and SMBS support, deprecates the CURL_GLOBAL_WIN32 symbol in favor of CURL_GLOBAL_WINSOCK, and changes how the tool’s --no-clobber option numbers files. Stenberg’s release post counts 281 bugfixes and a release cycle of 42 days.

The numbers behind the record

We tallied curl’s published vulnerability data by publication date. Each 2026 release shipped its CVEs on the day it came out, so the table doubles as a release-by-release count.

The 69 CVEs of 2026 compare with 86 for the seven years from 2019 to 2025 combined, and the last three releases account for 51 of them. The count also moved in the final week: Stenberg’s October 7 post promised the High “together with twenty-one other albeit less serious security vulnerabilities,” and the release shipped 24 in total. This batch is the largest, but 23 of its 24 are Low, a higher share than in any earlier 2026 release; 8.19.0 and 8.20.0 were Medium-heavy.

Who found them

Aisle says it found 18 of the 24, “or 75% of the total,” and that its audit has now produced 24 CVEs across two releases, six in 8.22.0 and 18 in 8.23.0. Do not confuse that 24 with the 24 in this release. Over twelve months Aisle counts 35 CVEs, and its audit report, which curl now links from its audits page, breaks them down as 34 in curl and libcurl plus one in wcurl, the download wrapper script that ships with curl. That explains why curl’s vulnerability list credits Aisle names on 34 entries: the wcurl CVE is not in that list. The report says “curl rated four of the findings Medium and the remaining 31 Low; none was rated High or Critical.”

Stenberg is warm about the work. In his post on the audit he writes that “Aisle has found more CVEs in curl than any other group or individual ever did before.” He adds: “With Aisle, we have a cooperation like with no other security organization before.” The public data supports the first claim: 34 entries credit Aisle’s researchers (Fort 20, Rogers 14), against 29 for Harry Sintonen, the most of any single finder in the list. Aisle describes its method in its own words: the system “attempts to disprove any potential finding before we send it to a maintainer,” “an AISLE security researcher reviews the complete report before submission,” and “curl, not AISLE, makes the ultimate call on assignment and responsible disclosure.” Those are the vendor’s claims about its process, not something the public record lets us check.

One pattern is worth noting. Aisle’s 35 CVEs are Low and Medium, and the one High in this release came from Anthropic’s report. That is a single data point, not a ranking of the two approaches, and the public record shows only what was accepted as a CVE, not what was rejected. Anthropic’s launch post said OSS Scanner’s output “will be fully model-generated, without human review or triage,” but this report arrived under a named researcher’s credit. The public report includes a recording, a malicious test server, a Docker reproduction and a suggested patch, and the credit line reads “Luna with Claude.” We cannot tell from public records how much of it was model work and how much human work.

Anthropic’s launch quote now has something to check against. On October 9, curl’s list credited nobody at Anthropic, so Stenberg’s quote could not be matched to any entry. As of October 14 it credits “Luna with Claude” and “Anthropic” on two CVEs, one of them the High that Stenberg calls “one of the worst vulnerabilities in curl in a long time.” The launch quote says “multiple issues” and “one of the worst,” which fits the public list without proving which entries it meant.

What we could not confirm

The link between the report and OSS Scanner rests on Stenberg’s post; we found no Anthropic statement about this specific report beyond the launch-post quote. We found no sign of exploitation, but the KEV catalog and NVD both change quickly. Aisle’s account of its validation process comes from Aisle. The curl output above describes two builds on one machine, and we did not build curl or run any exploit.

Sources and method

We read curl’s advisory for CVE-2026-92392 and its changelog; Stenberg’s posts of October 7 and 14 on the pending fixes, the release, the bug and the audit; the public HackerOne report; Aisle’s blog post and audit report; Anthropic’s launch post; Ubuntu’s blog post, two notices and CVE page; Debian’s tracker; the NVD record; and CISA’s KEV feed, which listed no curl entry at catalog version 2026.10.14. The counts come from our own tally of curl’s vuln.json, fetched on October 15, which holds 239 entries and so matches the total in Stenberg’s release post. Severity is curl’s own label, and credit counts use the names in each entry’s credits list. The --http1.1 option and the libcurl setting are described in curl’s man page and its CURLOPT_HTTP_VERSION page. Debian’s tracker and NVD were checked on October 15 and may have changed since.

Related coverage: Anthropic’s OSS Scanner and what the public records showed on launch day, and a Rejetto HFS flaw found with Anthropic Mythos that attackers exploited eleven weeks after its patch.