curl 8.23.0 fixes High-severity use-after-free CVE-2026-92392

curl 8.23.0, released October 14, 2026, ships 24 security fixes, including the High-severity use-after-free CVE-2026-92392 in HTTP/2 uploads. Versions 8.12.0 through 8.22.0, including embedded libcurl, are affected; a malicious server triggers the bug via RST_STREAM with HTTP_1_1_REQUIRED or REFUSED_STREAM.

• CVE-2026-92392 affects curl 8.12.0–8.22.0 and embedded libcurl
• Attacker is the server: RST_STREAM on HTTP/2 upload frees the handle
• Fixed in 8.23.0, backports in 8.20.2, 8.16.2 and 8.14.3
• 20 of the release's 24 CVEs were found with AI assistance