curl 8.23.0 ships early over a serious vulnerability

The curl project has announced that on October 14, 2026 it will ship version 8.23.0, the latest entry in its never-ending series of version bumps. As the developers put it, they always regard the next release as the best they have ever made, and this one is no exception — the product of decades of accumulated experience and meticulous polishing.

The release moved up

This time the development cycle was deliberately shortened so that 8.23.0 could arrive a few weeks earlier than originally planned. The trigger was a single vulnerability report that exposed a rather significant flaw. The new version removes that problem and, along with it, addresses twenty-one other, less serious vulnerabilities.

Severity HIGH

curl does not believe in CVSS scoring and assigns each CVE just one of four severity levels: LOW, MEDIUM, HIGH or CRITICAL. The HIGH rating has been handed out only twice since 2021, the most recent being CVE-2023-38545, which could lead to a heap buffer overflow.

A third case now joins them: CVE-2026-92392.

The details come next week

Everything about CVE-2026-92392 will become public on the European morning of October 14, in sync with the release of the fixed 8.23.0. Updated Rock-solid curl builds will go out at the same time.

For the sake of users everywhere — and of all the infrastructure that leans on curl — no details will surface before that date. The distros@openwall mailing list and paying support customers will be alerted to the problem and its fix ahead of time.

Daniel Stenberg promised a follow-up post after October 14 explaining the flaw in detail: how it can be triggered, why it is not quite the end of the world, and what the project does to guard against this class of problems.

Source: Lobsters