curl 8.23.0 fixes 24 vulnerabilities, one high-severity

The curl project has released version 8.23.0 with fixes for twenty-four security vulnerabilities, project lead Daniel Stenberg announced.

One flaw is rated high severity. CVE-2026-92392 is a use-after-free during HTTP/2 uploads. While curl is sending data over that protocol, memory can be freed and still used, risking crashes or memory corruption for clients that rely on HTTP/2 transfers.

The other twenty-three issues are rated low. A large cluster involves credentials and connection reuse leaving their intended scope: passwords exposed through CURLINFO_EFFECTIVE_URL, Authorization Negotiate headers sent to foreign origins, host credentials leaked to an HTTP proxy, Negotiate state following redirects or reused across origins, and client certificates attached to the wrong reused FTP or auto-selected TLS connection. Redirects to SFTP or SCP could also skip host verification, and stale SigV4 headers could go out on unintended requests.

Cookie and HSTS handling contributed several more low-severity failures. Server-set cookies could abort or erase a cookie jar during load, and HSTS responses could wipe persisted entries or drop longer-lived child hosts on cache import. Remaining fixes cover protocol edge cases in FTP wildcards, TFTP direction handling, IMAP APPEND with CRLF conversion, WebSockets uploads under GnuTLS, MIME free recursion, a wolfSSL public-key pinning bypass, a known-host callback mismatch, a possible infinite loop when a server omits expected response data, and a -J no-clobber bypass via 103 early hints.

Operators and distributors of the curl tool and libcurl should move to 8.23.0. The project published a separate advisory for each CVE with the release.