curl 8.23.0 fixes 24 flaws, one rated high, and drops SMB support

curl 8.23.0 fixes 24 flaws, one rated high, and drops SMB support

14 October 2026: curl 8.23.0, released on 14 October, fixes 24 security vulnerabilities in the command-line tool and the libcurl library that thousands of applications embed. curl's security table rates one of them high: CVE-2026-92392, a use-after-free in HTTP/2 uploads that affects curl 8.12.0 through 8.22.0. The other 23 are rated low. The release also removes SMB support entirely.

The one high-rated flaw

CVE-2026-92392 sits in the HTTP/2 upload path, which makes it relevant to any application that sends data over HTTP/2 with libcurl, not only to people using the curl command. curl's table lists it as affecting versions from 8.12.0, released early in 2025, to 8.22.0. Use-after-free bugs can crash a program and, in the worst case, be turned into code execution; curl's own advisory page for the CVE gives the detail, and heise reports that the flaw can allow code to be run.

A cluster of credential and session leaks

Most of the low-rated flaws concern where credentials and connections end up. Several involve Negotiate authentication: credentials sent to a redirected origin, an Authorization header sent to a foreign origin, and cross-origin reuse of a Negotiate connection, all introduced in 8.21.0. Others leak host credentials to an HTTP proxy, leak a password in CURLINFO_EFFECTIVE_URL, reuse a connection with the wrong client certificate, or let a redirect to SFTP or SCP bypass host verification. There are also flaws in cookie and HSTS handling, a wolfSSL public-key pinning bypass, and a command injection in IMAP APPEND when CRLF conversion is on.

Individually each is rated low, usually because it needs an unusual combination of options. Together they are a reason not to skip this release in software that handles authenticated requests through proxies or redirects.

SMB support is gone

The changelog for 8.23.0 lists "SMB: drop support". Any script or application that uses smb:// or smbs:// URLs through curl will stop working after the upgrade and needs another client.

What to update

The command-line tool on servers and developer machines usually comes from the operating system's packages, so the fix arrives through distribution updates. The larger exposure is libcurl bundled inside other products, from language runtimes to device firmware, which only their vendors can update. Teams should check their software bill of materials for libcurl versions from 8.12.0 to 8.22.0 and ask suppliers when they will ship 8.23.0.

Related on TrustList:

• Shopify switches off its Global Catalog REST API on 2 November

Sources

• curl: Security vulnerabilities table, 14 October 2026
• curl: Changelog, 8.23.0, 14 October 2026
• heise online: Neue curl-Version entfernt SMB-Unterstützung und behebt 24 Sicherheitslücken, 14 October 2026