Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure client to malicious/compromised server
-
ExploitSend response with required portion omitted
-
ExecutionClient enters never-ending loop
-
ImpactTransfer hangs and consumes resources
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim's curl/libcurl client to initiate a transfer to a server that is attacker-controlled, compromised, or manipulable by an on-path attacker; the malicious server then omits an expected part of its response, driving the client into an infinite loop. Affected versions are curl 8.10.0 through 8.22.0 (fixed in 8.23.0). Limiting factors: the attacker cannot act purely remotely against a listening service - curl is a client, so the victim must be induced to connect outbound to the malicious endpoint; impact is limited to a hung/looping transfer (availability of that client/process) with no confidentiality or integrity effect; and the specific protocol or response element that must be omitted is not detailed in the available advisory text. |
| Impact | No quantitative risk signals are present in the input: CVSS score and vector are N/A, CWE is N/A, and there is no EPSS, KEV, POC, or SSVC data provided - so a formal priority score cannot be computed from the source material. The authoritative signal that IS present is the vendor's own severity rating: the curl project classifies CVE-2026-92387 ('never-ending loop via server response omission') as LOW, one of twenty-three LOW issues released alongside a single HIGH issue (the unrelated CVE-2026-92392 HTTP/2 Use-After-Free). The nature of the bug - a never-ending loop triggered when a server omits part of its expected response - is a denial-of-service/resource-consumption condition affecting the client that made the request, not a memory-corruption or code-execution flaw, which is consistent with the LOW rating. Real-world risk is modest: exploitation requires the victim's curl/libcurl client to connect to a server the attacker controls or can manipulate (or an on-path attacker), and the impact is limited to hanging/stalling the individual transfer rather than compromising confidentiality or integrity. Despite curl's near-universal deployment, this should be treated as routine patch-and-move-on maintenance rather than an emergency, absent any evidence of exploitation. Note explicitly: no CVSS vector was supplied, so authentication and attack-complexity characterizations below are inferred from the advisory text, not confirmed by a vendor-provided vector. |
| Exploit ScenarioDerived | A victim uses curl or libcurl to fetch data from a server that the attacker controls or can tamper with on the network path. The server deliberately omits an expected portion of its response, causing the client to enter an infinite loop and hang indefinitely, consuming CPU or stalling the application that embeds libcurl. No public exploit code has been identified in the provided data, and the impact is confined to availability of the requesting client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A never-ending loop condition in curl and libcurl 8.10.0 through 8.22.0 lets a malicious, compromised, or on-path-manipulated server hang the client by omitting an expected part of its response, producing availability-only impact (the affected transfer or process spins indefinitely) with no confidentiality or integrity effect. The curl project rates this flaw LOW severity, and it is one of twenty-four CVEs disclosed alongside the curl 8.23.0 release. Exploitation requires the victim to connect outbound to the attacker's endpoint, since curl is a client and cannot be attacked purely remotely against a listening service; the exploit is not confirmed as actively exploited (not in CISA KEV), no public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
RemediationAI
Upgrade to curl/libcurl 8.23.0, the release that contains the fix for CVE-2026-92387 along with the other twenty-three advisories published in this batch; the oss-security advisory states that every fix is linked to its corresponding upstream commit, and those commits are reachable from https://curl.se/docs/security.html. No vendor-released patch version other than 8.23.0 is identified in the input data, and for libcurl consumers the fix must be picked up by rebuilding or replacing the bundled library rather than only updating the curl binary. Where an immediate upgrade is not possible, compensating controls should target the client-side nature of the bug: enforce explicit transfer timeouts (curl's --max-time / --connect-timeout, or CURLOPT_TIMEOUT / CURLOPT_CONNECTTIMEOUT in libcurl) so a looping transfer is aborted, noting the trade-off that aggressive values will prematurely kill legitimately slow large downloads; enable low-speed abort thresholds (--speed-limit with --speed-time, or CURLOPT_LOW_SPEED_LIMIT / CURLOPT_LOW_SPEED_TIME) to terminate stalled transfers that produce no progress, at the cost of failing transfers over genuinely slow links; wrap automated curl invocations in supervisors with process-level watchdogs and restart limits so a hung worker cannot consume a thread or slot indefinitely; and restrict automated clients from connecting to untrusted or user-supplied endpoints where the attacker-controlled server condition is easiest to arrange, though this limits legitimate functionality. None of these controls fixes the underlying parsing defect - they only bound the damage - so the 8.23.0 upgrade remains the definitive remediation.
Affected ProductsAI
curl and libcurl versions 8.10.0 through 8.22.0 inclusive are affected by CVE-2026-92387, per the curl project vulnerability table (first affected 8.10.0, last affected 8.22.0); the fix is delivered in curl 8.23.0. The issue was published 2026-10-14 as one of twenty-four advisories released with curl 8.23.0, and the entry's table row does not distinguish between the curl tool and the libcurl library, so downstream applications statically or dynamically linking libcurl in the 8.10.0-8.22.0 range (or bundling curl) should also be treated as potentially affected. No CPE identifiers were provided in the source data. Vendor advisory material is available at https://curl.se/docs/security.html and in the oss-security posting https://seclists.org/oss-sec/2026/q4/154; commercial long-term-support customers of Rock-solid curl (https://rock-solid.curl.dev), which backports security and selected stability fixes to LTS branches for five years, should check with that program for a backported fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
curl is the ubiquitous command-line transfer tool and libcurl library - the project cites more than twenty billion installations spanning cars, routers, printers, mobile devices, media players and embedded/medical systems - and libcurl serves as the transfer engine for countless applications. This issue is client-side: when a server returns a response that omits some element the client expects, curl/libcurl fails to detect the incomplete state as terminal and loops indefinitely rather than erroring out or completing, which is behaviorally consistent with the CWE-835 (Loop with Unreachable Exit Condition) / uncontrolled-resource-consumption class, although no CWE identifier was supplied in the source material and the advisory text does not detail which protocol or which specific response element must be omitted. In the project's vulnerability table the entry carries no 'lib' or 'tool' marker, so the sources do not confirm whether the curl command-line tool, the libcurl library, or both are implicated, though the affected version range 8.10.0-8.22.0 spans both distribution channels. All twenty-four advisories in this batch are documented at https://curl.se/docs/security.html, each linking to the specific upstream commit that fixes it; the sibling HTTP/2 upload use-after-free (CVE-2026-92392) is the only one rated HIGH, while this entry is rated LOW.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-reachable malicious server triggers the loop with no auth or interaction (AV:N/PR:N/UI:N); only the affected client transfer hangs, so A:L and no C/I impact, matching curl's LOW rating.
Description PRE-NVD
Executive ViewAI
CVE-2026-92387 is a high-severity availability flaw in curl and libcurl versions 8.10.0 through 8.22.0 that allows a malicious or compromised server to hang outbound client connections indefinitely. Organizations using these versions in applications or services could experience operational disruptions, such as hung processes or degraded performance, though there is no risk to data confidentiality or integrity. No public exploit identified at time of analysis, but leadership should prioritize remediation because the affected library is widely embedded in software and infrastructure, and exploitation requires only that a system connect to an attacker-controlled endpoint.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing strict client-side timeouts (e.g., CURLOPT_TIMEOUT), limiting maximum response sizes, monitoring for hung curl processes, and restricting outbound connections to trusted endpoints.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB