<![CDATA[curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution]]>The curl project has patched a memory corruption issue affecting how the tool handles HTTP/2 uploads. The flaw allows a malicious server receiving an upload to corrupt the uploading client's memory, and the researcher who reported it was able to turn that corruption into code execution on the client machine.

The fix landed on October 14 in curl 8.23.0.

Exploiting this in the wild is not straightforward. Taking over a client requires exact knowledge of its specific build and memory layout, which significantly narrows the pool of practical targets. According to the curl project, a real-world attack is expected to result in a crash rather than reliable compromise.

  • Update to curl 8.23.0 or later to address the flaw.
  • Treat uploads to untrusted or attacker-controlled HTTP/2 servers as a potential risk until patched.

Note: The project has not published a specific advisory identifier for this issue in the available reporting.

Source: The Hacker News

Has your organization already rolled out curl 8.23.0, or are you still assessing exposure across your build pipelines?

]]>https://xploitlk.com/topic/731/curl-patches-http-2-upload-flaw-after-poc-demonstrates-client-side-code-executionRSS for NodeTue, 27 Oct 2026 07:48:45 GMTSun, 18 Oct 2026 14:30:21 GMT60