curl Patches HTTP/2 Upload Vulnerability Demonstrating Client-Side Code Execution

The curl project has addressed a significant vulnerability in its HTTP/2 implementation. The flaw resides in the upload handling mechanism, where a malicious server receiving an upload can send data that corrupts the client's memory structures. According to the project's advisory and reporting, the researcher was able to take advantage of this memory corruption to achieve code execution on the machine initiating the upload.

Exploitation of this vulnerability is complex. An attacker must possess exact knowledge of the target curl binary's build configuration and memory layout. The curl project notes that in a real-world attack scenario, the likely outcome is a crash rather than successful code execution, due to the specificity required for reliable exploitation.

The vulnerability was fixed in curl version 8.23.0, released on October 14, 2026. Users are strongly advised to upgrade to this version or later to mitigate the risk. The fix addresses the specific handling of HTTP/2 upload data to prevent the memory corruption that could lead to code execution.