curl 8.23.0 Patches HTTP/2 Upload Flaw Enabling Client Code Execution

curl 8.23.0, released October 14, fixes a flaw in HTTP/2 upload handling that let a malicious server corrupt the uploading client's memory; the reporting researcher turned it into code execution on the client machine. Exploitation requires exact knowledge of the client's build and memory layout, and curl expects a real attack to end in a crash.

• HTTP/2 upload flaw let a malicious server corrupt client memory
• Fix shipped October 14 in curl 8.23.0
• Researcher demonstrated code execution on the uploading machine
• Attack needs exact build and memory layout, typically ends in a crash