CVE-2026-92392 concerns transfer cleanup after selected HTTP/2 reset responses. Demonstrated code execution depended on specific allocator behavior, concurrency, library and timing conditions. The source does not establish routine remote code execution or attacks against deployed users. The advisory credits an AI-assisted discovery involving Anthropic Luna…
Inspect the ClaimsCase · DiggingBeagle record
curl HTTP/2 reset processing could use a freed transfer object
An HTTP/2 upload reset flaw had a narrowly conditioned code-execution proof of concept and a patch in curl 8.23.0.
Scope
Research claim attributed to the cited report, with limitations from intake DB-RADAR-CP7-CP7A-030.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- fixed reported
- AI role
- WITH AI
Basis and provenance
The curl advisory attributes AI assistance to discovery, not attack execution. The code-execution proof used narrow allocator and transfer-state conditions, with no field exploitation established. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7A-CURL-H2-UAF · curl HTTP/2 reset use-after-free exploited to code execution in tightly controlled environment — original research or disclosure
At a glance
Independent reproduction or full primary-document access in this research run was not achieved. Real-world incidence and broader model or deployment generalization are not established unless specifically stated.
Limits and uncertaintyFull account
CVE-2026-92392 concerns transfer cleanup after selected HTTP/2 reset responses. Demonstrated code execution depended on specific allocator behavior, concurrency, library and timing conditions. The source does not establish routine remote code execution or attacks against deployed users.
The advisory credits an AI-assisted discovery involving Anthropic Luna with Claude. WITH AI describes vulnerability identification, not any observed AI-operated exploitation.
HTTP/2 stream reset can change transfer cleanup timing; this cannot be collapsed into a claim that any remote server can execute code through curl. Affected-version and linked-library reachability must be established separately.
Claims & evidence
CLM-CP7A-CURL-H2-UAFThe cited authors or maintainers report the following bounded finding: An HTTP/2 upload reset flaw had a narrowly conditioned code-execution proof of concept and a patch in curl 8.23.0.supported
Basis: reported finding
- supportscurl HTTP/2 reset use-after-free exploited to code execution in tightly controlled environment — original research or disclosureprimary disclosure
Original primary document, reported finding and evaluation context; checkpoint DB-RADAR-CP7-CP7A-030
Unknowns and contradictions
- Independent reproduction or full primary-document access in this research run was not achieved.
- Real-world incidence and broader model or deployment generalization are not established unless specifically stated.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150