Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInfluence application to build deeply nested MIME tree
-
ExploitTrigger recursive curl_mime_free teardown
-
ImpactExhaust call stack and crash process
Vulnerability Assessment
| Exploitation Conditions | Requires a libcurl-based application that uses the curl_mime API (curl_mime_init / curl_mime_addpart / curl_mime_subparts) and permits deeply nested MIME part hierarchies whose depth can be influenced by untrusted input; curl_mime_free() then recurses per nesting level and exhausts the stack. Exploitation is limited to such applications (not plain command-line curl transfers without MIME nesting), the impact is confined to a denial-of-service crash with no code execution or data disclosure, and the attacker must be able to control or inflate the MIME nesting depth rather than merely act as a remote network peer. Affected libcurl 7.56.0 through 8.22.0; fixed in 8.23.0. |
| Impact | This is a genuinely low-priority issue, and the available signals are consistent in pointing that way. The curl project itself rates CVE-2026-92391 as severity LOW, and it is a memory-safety/robustness flaw rather than a code-execution bug: curl_mime_free() frees nested MIME part structures recursively, so a sufficiently deeply nested MIME tree can exhaust the call stack and crash the process. No CVSS vector, EPSS score, KEV listing, or public POC is provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The key limiting factor is that the recursion depth is driven by how the application (not a remote peer) builds its MIME structure via the curl_mime_* API; an attacker generally must influence the application into constructing an extremely deep part hierarchy. Note the asymmetry: curl/libcurl is one of the most widely deployed libraries in existence (ubiquitous footprint), yet this specific defect is confined to applications that use the MIME-building API, carries availability-only impact, and is vendor-rated LOW - a classic 'ubiquitous product, narrow and low-impact flaw' case. Authentication requirements cannot be stated because no CVSS vector was provided. |
| Exploit ScenarioDerived | An application uses libcurl's curl_mime API and allows the number/depth of MIME parts to be influenced by untrusted input. An attacker drives the creation of a deeply nested MIME part hierarchy; when the application calls curl_mime_free(), the recursive teardown exhausts the thread stack and crashes the process, causing a denial of service. No public exploit code is identified at the time of analysis, and the attacker needs the ability to influence the MIME structure the application builds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stack exhaustion in libcurl's MIME handling can crash applications that construct deeply nested multipart structures: curl_mime_free() recurses once per nesting level, so a sufficiently deep curl_mime_subparts() hierarchy overflows the stack and aborts the process. Affected are libcurl/curl versions 7.56.0 through 8.22.0, fixed in 8.23.0; the curl project classifies this advisory as LOW severity, with the impact limited to denial of service (no code execution, no data disclosure). The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that exploitation is confined to libcurl-based applications that let untrusted input dictate MIME nesting depth, and there is no public exploit identified at time of analysis.
RemediationAI
Upgrade to curl/libcurl 8.23.0 (vendor-released patch: 8.23.0), which ships the upstream fix for CVE-2026-92391 and the other twenty-three advisories published in the same release; verify the exact fix commit and per-version guidance in the curl security page at https://curl.se/docs/security.html and the announcement at https://seclists.org/oss-sec/2026/q4/154. Where an immediate upgrade is not possible, the effective compensating control is to bound recursion input rather than to enlarge the stack: validate and cap the nesting depth of any multipart/MIME structure derived from untrusted input before calling curl_mime_subparts(), reject or flatten payloads exceeding a fixed depth (for example a small constant such as 8-16 levels), and avoid exposing MIME construction patterns to arbitrary attacker-supplied schemas. Raising the thread stack size or running the process under a stack-limit is only a threshold shift, not a fix, and carries the trade-off of higher memory use while still crashing on a sufficiently deep hierarchy; sandboxing or restart-on-crash supervision limits availability impact but does not remove the defect. Applications that do not use the curl_mime API and do not recurse over MIME parts are not exploitable via this path, so prioritization should target services that build multipart bodies from user-controlled data; note that the curl project rates this LOW and that no public exploit is identified at time of analysis.
Affected ProductsAI
curl and libcurl versions 7.56.0 through 8.22.0 are vulnerable, with the code path reachable by any libcurl-based application that uses the MIME API (curl_mime_init, curl_mime_addpart, curl_mime_subparts) and allows external input to shape multipart nesting depth; plain curl command-line transfers that do not build nested MIME subparts are not meaningfully exposed. The issue is fixed in curl/libcurl 8.23.0, released 2026-10-14, which contains the fix commit referenced from the per-CVE text in the curl security advisories index at https://curl.se/docs/security.html and summarized in the oss-security announcement at https://seclists.org/oss-sec/2026/q4/154. Organizations running curated downstream builds may also obtain the fix through the commercial long-term-support channel described at https://rock-solid.curl.dev, which applies security and selected stability patches to LTS branches for supported customers; that service is advisory context only and does not by itself indicate a fix for this specific CVE in every LTS branch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This issue lives in the curl_mime API used by libcurl-embedding applications: callers build a multipart body with curl_mime_init(), curl_mime_addpart() and curl_mime_subparts(), producing a tree of MIME parts where a part can itself contain further subparts. Teardown is performed by curl_mime_free(), which walks that tree recursively; because the recursion depth is proportional to the nesting depth of the part hierarchy, an attacker who can influence how deeply subparts are nested (for example by driving the application's construction of a multipart payload from untrusted input) can force unbounded recursion until the thread stack is exhausted and the process crashes. The CWE is not assigned in the supplied data, but the root-cause class is uncontrolled recursion leading to stack exhaustion rather than an out-of-bounds write; the assessed AV:L vector confirms the practical threat model is a locally/application-controlled input influencing MIME depth, not a remote peer merely sending a request. The defect was introduced with the curl 7.56.0 MIME API and persisted through 8.22.0, and it was published as one of twenty-four advisories accompanying the curl 8.23.0 release (only CVE-2026-92392, the HTTP/2 upload use-after-free, was rated HIGH; this one was rated LOW).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Recursion depth is driven by the application's own MIME construction rather than a remote peer, so AV:L; impact is an availability-only process crash, hence C:N/I:N/A:L.
Description PRE-NVD
Executive ViewAI
A stack-exhaustion flaw in libcurl's MIME handling (CVE-2026-92391) can abort any application built on libcurl/curl versions 7.56.0 through 8.22.0 that lets untrusted input determine how deeply nested a multipart structure becomes, so the process crashes instead of executing code or leaking data. The practical exposure is downtime for internet-facing or partner-facing services that parse untrusted file or form uploads through libcurl - including third-party and embedded components that may not be visible in a standard software inventory. Leadership should treat this primarily as an availability and dependency-visibility risk rather than a breach risk.
No vendor-released patch identified at time of analysis (vendor advisory indicates the issue is addressed in libcurl/curl 8.23.0 - validate and deploy that build as soon as it is confirmed available for your platform). Interim mitigations: validate or hard-limit MIME/multipart nesting depth in application code and at API gateways or reverse proxies before input reaches curl_mime_subparts(); reject oversized or unusually structured multipart uploads; run affected services under least-privilege accounts with memory and file-descriptor limits and automatic restart so a crash causes minimal disruption; rate-limit and authenticate upload endpoints to reduce the ability to trigger repeated crashes; and monitor for unexpected process aborts or restarts in libcurl-based services.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB