Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim runs curl -J --no-clobber
-
DeliveryMalicious server returns 103 Early Hints
-
ExploitContent-Disposition sets target filename
-
ExecutionNo-clobber guarantee bypassed
-
ImpactExisting local file overwritten
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the curl command-line tool (not libcurl) to be invoked with BOTH the -J/--remote-header-name flag AND the --no-clobber flag - a specific, non-default combination the user must choose. The connected HTTP server (or a man-in-the-middle) must send a 103 Early Hints interim response containing a Content-Disposition header. Limiting factors: the victim must actively initiate the transfer with these exact options, the impact is confined to overwriting a local file the no-clobber option was meant to protect (no confidentiality or availability impact), and affected versions are curl 7.20.0 through 8.22.0, fixed in 8.23.0. |
| Impact | No CVSS vector, EPSS score, KEV entry, or POC is provided in the input, so this assessment relies on the curl project's own LOW severity rating and the vulnerability mechanics. The flaw affects only the curl command-line tool (component tagged 'tool'), not libcurl, and only when the user explicitly combines the -J/--remote-header-name option with --no-clobber - a deliberate, non-default invocation. The real-world risk is low: although curl itself is ubiquitous, exploitation requires a victim to actively run a specific flag combination against an attacker-influenced server, and the impact is limited to bypassing the no-clobber guarantee (unintended local file overwrite) rather than code execution, data theft, or privilege gain. There is no indication of active exploitation (not in CISA KEV) and no public exploit identified. This is a correctness/safety-guarantee bypass, not a widespread-exploitation priority; prioritize patching via the routine upgrade to curl 8.23.0 rather than as an emergency. |
| Exploit ScenarioDerived | A user downloads a file with 'curl -J --no-clobber' from a server they do not fully control (or via a MITM), expecting an existing local file to be preserved. The server returns a 103 Early Hints interim response carrying a Content-Disposition header, which curl uses to derive the output filename while failing to honor the no-clobber check, causing the pre-existing file to be overwritten. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local file overwrite in the curl command-line tool (versions 7.20.0 through 8.22.0) occurs when a user runs a transfer with both the -J/--remote-header-name option and --no-clobber, and the connected HTTP server - or a man-in-the-middle on the connection - sends a 103 Early Hints interim response containing a Content-Disposition header. Because the early-hints header is honored for filename selection before the no-clobber protection is applied, an attacker-influenced filename can cause curl to overwrite a local file that --no-clobber was explicitly intended to protect, with impact limited to integrity of that file (no confidentiality or availability effect). The curl project rates this LOW, exploitation requires the victim to actively choose a specific non-default option combination, and no public exploit code or CISA KEV entry is identified at time of analysis; the flaw is fixed in curl 8.23.0.
RemediationAI
Vendor-released patch: curl 8.23.0, which contains the fix for this issue and the other twenty-three advisories in the same release - upgrade the curl tool to 8.23.0 or later, verifying the artifact against the release checksums described on the curl site. Full details and the fixing commit link are published at https://curl.se/docs/security.html, with the release announcement at https://seclists.org/oss-sec/2026/q4/154. If an immediate upgrade is not possible, the practical workaround is to stop combining the two options: avoid using -J/--remote-header-name (supply an explicit output path with -o instead, which removes the server's ability to influence the filename) or avoid relying on --no-clobber to protect an existing file, and instead download into a dedicated empty directory or pre-check the target filename yourself. Note the trade-offs - dropping -J requires the user or script to know the intended filename in advance and can break automation that depends on server-suggested names, while dropping --no-clobber removes overwrite protection entirely and is therefore the weaker of the two changes. Using --no-clobber without -J remains safe because the server cannot dictate the filename in that configuration. There is no server-side control that prevents this on the client, and filtering 103 Early Hints at a proxy would break the intended performance benefit of that feature, so client-side upgrade or option changes are the reliable mitigations; note that no vendor-released workaround advisory beyond the 8.23.0 upgrade is referenced in the available data.
Affected ProductsAI
The curl command-line tool is affected from version 7.20.0 through 8.22.0 inclusive, per the curl project's own vulnerability table (advisory entry listed as tool-only, not libcurl); the fix ships in curl 8.23.0. Because no CPE string was provided in the input, the version range above is the authoritative scoping data. This issue is one of twenty-four advisories published alongside the curl 8.23.0 release on 2026-10-14 (see the oss-security announcement at https://seclists.org/oss-sec/2026/q4/154 and the curl security page at https://curl.se/docs/security.html); note that the same release addressed a HIGH-severity HTTP/2 upload use-after-free (CVE-2026-92392, curl 8.12.0 through 8.22.0), which should be prioritized ahead of this LOW-rated tool issue, plus a large set of other LOW-severity libcurl and tool issues. Long-term-support customers using Rock-solid curl branches (https://rock-solid.curl.dev) should obtain the corresponding backported fix through their support contract rather than a mainline upgrade.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
curl is both a command-line transfer tool and the libcurl library; this advisory is tagged as affecting the curl tool only, not libcurl, so applications embedding libcurl are not exposed by this specific issue. Two user-facing options interact here: -J/--remote-header-name tells the curl tool to derive the local output filename from the server's Content-Disposition response header rather than from the URL, and --no-clobber instructs curl never to overwrite an existing file (it appends a numeric suffix instead). HTTP 103 Early Hints (RFC 8297) is an interim response that a server may send before the final response headers, and curl processes headers received in that interim response. The defect is a protection-mechanism bypass: the filename taken from the 103 Early Hints Content-Disposition header was accepted in a code path that did not honor the no-clobber guarantee, so the safeguard could be defeated by an early interim response. No CWE identifier is supplied in the input data, and no CVSS vector, EPSS score or KEV record is provided either; the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, i.e. network-reachable and requiring no authentication against the target but requiring the user to initiate the transfer with the vulnerable option pair, with a low-integrity impact and no confidentiality or availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Attacker is a network server (AV:N) needing no privileges (PR:N), but the victim must actively run curl with -J and --no-clobber (UI:R); only local file integrity is affected (I:L, C:N, A:N).
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB