curl DSA-6558-1 (October 2026): HTTP/2 upload use-after-free CVE-2026-92392 fixed in Debian 13

On 14 October 2026 Debian released DSA-6558-1 for curl in Debian 13 (trixie). The main fix is CVE-2026-92392, a use-after-free in libcurl when a server resets an HTTP/2 stream during an upload; curl rates it High. The same update brings forward three smaller curl fixes that Debian had planned for the trixie 13.8 point release. Debian 12 (bookworm) is not affected by the main flaw.

At a glance

What the vulnerabilities are

• CVE-2026-92392, HTTP/2 upload use-after-free (High). During an upload, libcurl mishandles an HTTP/2 RST_STREAM from the server with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM and then uses memory that has already been freed. Debian says this "could result in remote code execution". The curl advisory explains that turning it into code execution was shown to be possible only when a malicious server meets a long list of specific conditions, including exact knowledge of the curl build, architecture and heap layout. Affected upstream versions are 8.12.0 to 8.22.0, which is why trixie's 8.14.1 is affected and bookworm's 7.88.1 is not.
• CVE-2026-8927, proxy Digest credentials sent to the wrong proxy (Medium). When one libcurl handle is reused for transfers whose proxy comes from environment variables, the Proxy-Authorization header for one proxy could be sent to another. curl notes this does not affect the curl command-line tool.
• CVE-2026-8924, trailing-dot "super cookies" (Low). A malicious server could set cookies for a whole public suffix such as co.uk. when a hostname with a trailing dot is used.
• CVE-2026-8286, STARTTLS connection reuse (Low). Transfers that start in cleartext and upgrade to TLS (IMAP, POP3, SMTP, FTP, LDAP) could reuse a connection whose TLS settings did not match.

CISA's assessments on cve.org record a public proof of concept for these CVEs. None is listed in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.

Are you affected?

libcurl is used far beyond the curl command. On trixie, PHP's curl extension (php8.4-curl) uses libcurl4t64 and git uses libcurl3t64-gnutls for HTTPS remotes. Check every installed curl package:

dpkg -l curl 'libcurl*'
apt policy libcurl4t64 libcurl3t64-gnutls

On Debian 13, anything older than 8.14.1-2+deb13u7 needs the update. On Debian 12 the security tracker marks CVE-2026-92392 as not affecting bookworm ("vulnerable code not present") and lists the other three as postponed minor issues, so there is no new bookworm package for this advisory. Debian 11 (bullseye) is past the end of LTS and should be upgraded.

How to update

sudo apt update
sudo apt upgrade

Or update only curl and libcurl:

sudo apt install --only-upgrade curl libcurl4t64 libcurl3t64-gnutls

apt skips packages that are not installed. Ubuntu ships different curl builds; check Ubuntu Security Notices for Ubuntu servers.

Restart or reboot?

No reboot is needed. One-off curl commands pick up the new library on their next run, but long-running processes that loaded libcurl keep the old copy. The usual example is PHP-FPM:

sudo needrestart -r l
sudo systemctl restart php8.4-fpm

Restart any other service that needrestart lists, such as application workers that make HTTP calls.

Sources

• security-tracker.debian.org/tracker/DSA-6558-1
• debian.org/security/2026/dsa-6558
• lists.debian.org/debian-security-announce/2026/msg00472.html
• curl.se/docs/CVE-2026-92392.html
• curl.se/docs/CVE-2026-8927.html
• curl.se/docs/CVE-2026-8924.html
• curl.se/docs/CVE-2026-8286.html
• curl.se/docs/vuln.json
• cve.org/CVERecord?id=CVE-2026-92392
• security-tracker.debian.org/tracker/CVE-2026-92392
• security-tracker.debian.org/tracker/CVE-2026-8286
• security-tracker.debian.org/tracker/curl
• packages.debian.org/source/trixie/curl
• packages.debian.org/trixie/php8.4-curl
• packages.debian.org/trixie/git
• manpages.debian.org/trixie/needrestart/needrestart.1.en.html
• manpages.debian.org/trixie/apt/apt-get.8.en.html