Skip to content
OpenAdvisories
High ELSA-2026-96092 1 CVE

Important: curl security update (Oracle Linux 10)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Oracle Linux

Summary

[8.12.1-4.el10_2.8]
- fix HTTP/2 upload use-after-free in multi_done (CVE-2026-92392)

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 curl 0:8.12.1-4.el10_2.8
Oracle Linux · 10 libcurl 0:8.12.1-4.el10_2.8
Oracle Linux · 10 libcurl-devel 0:8.12.1-4.el10_2.8
Oracle Linux · 10 libcurl-minimal 0:8.12.1-4.el10_2.8

Vulnerabilities 1

  • High 8.1
    CVE-2026-92392 Public exploit

    HTTP/2 upload Use-After-Free

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi