Evidence · DiggingBeagle record
curl HTTP/2 reset use-after-free exploited to code execution in tightly controlled environment — original research or disclosure
Reported evidence for An HTTP/2 upload reset flaw had a narrowly conditioned code-execution proof of concept and a patch in curl 8.23.0. Research intake: DB-RADAR-CP7-CP7A-030.
- Source role
- primary disclosure
Evidence record
Reported evidence for An HTTP/2 upload reset flaw had a narrowly conditioned code-execution proof of concept and a patch in curl 8.23.0. Research intake: DB-RADAR-CP7-CP7A-030.
Claim-level citations (1)
- supportscurl HTTP/2 reset processing could use a freed transfer object: The cited authors or maintainers report the following bounded finding: An HTTP/2 upload reset flaw had a narrowly conditioned code-execution proof of concept and a patch in curl 8.23.0.
Original primary document, reported finding and evaluation context; checkpoint DB-RADAR-CP7-CP7A-030