> Debian curl Critical Use-After-Free RCE DSA-6558-1 CVE-2026-92392
[DATE: 14/10/2026 06:14]
[LANGUAGE: EN]
It was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution. For the stable distribution (trixie), this problem has been fixed in