The curl project fixed an HTTP/2 upload vulnerability on October 14, 2026, in curl 8.23.0 after a researcher demonstrated it could lead to client-side code execution.
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory. The researcher who reported the issue turned that memory corruption into code execution on the uploading machine.
Taking over a client requires exact knowledge of its build and memory layout, and the curl project expects a real attack to end in a crash.
Sources and references
Original report
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00JQ1QF5
Cite this
APA
Interestana AI Editorial. (2026, October 14). Curl Patches HTTP/2 Upload Flaw After Code Execution Demo. Interestana. https://interestana.com/articles/curl-patches-http2-upload-flaw-after-poc-demonstrates-client-side-code-execution-00jq1qf5
MLA
“Curl Patches HTTP/2 Upload Flaw After Code Execution Demo.” Interestana, 14 Oct. 2026, interestana.com/articles/curl-patches-http2-upload-flaw-after-poc-demonstrates-client-side-code-execution-00jq1qf5.
Chicago
Interestana AI Editorial. “Curl Patches HTTP/2 Upload Flaw After Code Execution Demo.” Interestana, October 14, 2026. https://interestana.com/articles/curl-patches-http2-upload-flaw-after-poc-demonstrates-client-side-code-execution-00jq1qf5.
BibTeX
@misc{interestana_00jq1qf5,
author = {{Interestana AI Editorial}},
title = {{Curl Patches HTTP/2 Upload Flaw After Code Execution Demo}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/curl-patches-http2-upload-flaw-after-poc-demonstrates-client-side-code-execution-00jq1qf5},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html}
}Credit the source
Original reporting: The Hacker News, “curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution”, https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe