Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: curl: HTTP/2 upload Use-After-Free (CVE-2026-92392)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | curl | 8.12.1-4.el10_2.8 |
| AlmaLinux · 10 | libcurl | 8.12.1-4.el10_2.8 |
| AlmaLinux · 10 | libcurl-devel | 8.12.1-4.el10_2.8 |
| AlmaLinux · 10 | libcurl-minimal | 8.12.1-4.el10_2.8 |
Vulnerabilities 1
-
High 8.1CVE-2026-92392 Public exploit
HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.