As cited
Copy frozen at (site build).
vulnerabilities
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl released version 8.23.0 on October 14, 2026, to patch an HTTP/2 upload vulnerability that allows a malicious server to corrupt client memory. A researcher demonstrated that the flaw can lead to client-side code execution, though exploitation requires precise knowledge of the target's build and memory layout, with actual attacks likely resulting in a crash.
Why it matters: Developers and organizations using curl for uploads to untrusted or potentially compromised servers face code execution risk; immediate patching to version 8.23.0 or later is required.
- Source published
- First seen by Cybersecurity Tracker