What happened
curl 8.23.0, released on October 14, 2026, addresses CVE-2026-92392, a High-severity use-after-free vulnerability in HTTP/2 uploads. The flaw, affecting versions 8.12.0 through 8.22.0, was discovered by Anthropic researcher Luna Tong using Claude through Anthropic's OSS Scanner service. The release also includes 23 Low-severity fixes and removes support for SMB and SMBS protocols.
curl 8.23.0 was released on October 14, 2026, to fix CVE-2026-92392, a use-after-free vulnerability in HTTP/2 uploads. The project rates this flaw as High severity. It affects curl and libcurl versions from 8.12.0 through 8.22.0. The vulnerability occurs when curl handles an RST_STREAM frame with specific reasons during an upload, leaving a pointer to a deleted internal structure.
The flaw was discovered by Luna Tong of Anthropic with the help of Claude. The discovery was made through OSS Scanner, a service launched by Anthropic on October 8, 2026, which uses AI models to analyze open-source projects. The curl team confirmed the report within hours of it being submitted on September 15, 2026.
The release cycle for curl was shortened from eight weeks to six weeks to expedite the patch. The release includes 24 security fixes in total: one High severity and 23 Low severity. According to The Hacker News, this is the first High-severity fix since a SOCKS5 proxy overflow in October 2023.
In addition to the security fixes, curl 8.23.0 removes support for the SMB and SMBS protocols entirely from both the library and the command-line tool. This decision follows years of security issues associated with SMBv1 and NTLM dependencies. Users relying on smb:// or smbs:// addresses must update their scripts or pipelines to use SMBv2/v3 clients or other protocols.
Source details: pasqualepillitteri.it ↗
Why it matters
This incident highlights the growing role of AI in identifying critical security flaws in foundational open-source software. curl is ubiquitous in browsers, mobile apps, and CI/CD pipelines, making the vulnerability significant for system stability and security. The use of Claude to find the bug demonstrates a practical application of AI in security auditing, potentially accelerating the discovery of complex memory errors that have persisted for multiple versions.
curl is a foundational tool used in browsers, mobile apps, routers, and continuous integration pipelines. A vulnerability in such a widely used library can have broad implications for system stability and security. The fact that the bug persisted for eleven versions before being identified by an AI model underscores the potential of AI to uncover complex, long-standing issues in C code.
The use of Claude to identify the vulnerability represents a significant step in the application of AI to security auditing. Anthropic's OSS Scanner service allows maintainers to request AI-driven audits of their projects, potentially accelerating the discovery of flaws that traditional methods might miss. This development could lead to more frequent and effective security patches in open-source software.
The incident also highlights the challenges of maintaining security in widely used open-source projects. The curl team's decision to shorten the release cycle and implement countermeasures such as reducing internal pointers to handles demonstrates a proactive approach to addressing security risks. However, the project acknowledges that further use-after-free bugs may occur in the future.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
What to watch next
Monitor for widespread adoption of curl 8.23.0 and backported fixes in 8.20.2, 8.16.2, and 8.14.3. Watch for further reports on the effectiveness of AI-driven security tools like OSS Scanner in identifying vulnerabilities in other major open-source projects. Additionally, observe any changes in how organizations integrate AI models into their security auditing workflows.
Track the adoption rate of curl 8.23.0 and the backported fixes in older versions. Since curl is often embedded in other software, the real work lies in identifying and updating all instances of the library across various systems and containers.
Monitor for further reports on the effectiveness of AI-driven security tools like OSS Scanner. If other major open-source projects adopt similar AI auditing processes, it could lead to a significant reduction in the time it takes to identify and fix critical vulnerabilities.
Observe how organizations integrate AI models into their security auditing workflows. The success of Claude in identifying the curl vulnerability may encourage more companies to explore AI-assisted security testing, potentially changing the landscape of open-source security.