RHSA-2026:96092HighCVSS 8.1

Red Hat Security Advisory: curl security update

Published
November 9, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-92392 →

📋 Description

CVE-2026-92392 — curl: curl: HTTP/2 upload Use-After-Free

🎯 Affected products51

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-0:8.12.1-4.el10_2.8.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debuginfo-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • curl-debugsource-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-0:8.12.1-4.el10_2.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-0:8.12.1-4.el10_2.8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-debuginfo-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libcurl-debuginfo-0:8.12.1-4.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libcurl-debuginfo-0:8.12.1-4.el10_2.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +21 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Disable HTTP/2 in curl. For the curl CLI, use the `--http1.1` flag. For applications using libcurl, set `CURLOPT_HTTP_VERSION` to `CURL_HTTP_VERSION_1_1`. This vulnerability is only exploitable over HTTP/2 connections; HTTP/1.1 connections are not affected. Note that applications which depend on HTTP/2-specific features, such as gRPC, will not function with this workaround.

🔗 References (4)