Affected Systems
curl and libcurl versions 8.12.0 through 8.22.0 with HTTP/2 support enabled. Affects both command-line tool and library used by third-party applications. Patched in curl 8.23.0 and backported to 8.14.3, 8.16.2, 8.20.2, and Debian 13 (8.14.1-2+deb13u7).
Exploitation Status
Proof-of-concept publicly available since October 14, 2026, demonstrating client-side code execution. No active exploitation reported in the wild. PoC includes malicious server script and Docker container. Exploitation requires precise knowledge of target build, memory layout, and exact timing.
Business Impact
Malicious or compromised servers can achieve remote code execution on curl clients during file uploads over HTTP/2. Attack requires client to upload ~135KB file to attacker-controlled server with valid certificate. Exploitation is complex (requires exact curl version, architecture, libc allocator knowledge, ASLR bypass, and 23-byte payload constraints), making crash more likely than successful RCE. First High-severity curl flaw since October 2023. Impacts any application using vulnerable libcurl versions for HTTPS uploads with HTTP/2 negotiation.
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade curl and libcurl to version 8.23.0 immediately, or apply branch-specific patches (8.14.3, 8.16.2, 8.20.2) if on older supported branches
- Identify all applications and systems using libcurl 8.12.0 through 8.22.0 via package managers, dependency scanners, and software inventories
- As interim mitigation, force HTTP/1.1 by using --http1.1 flag for curl CLI or set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in applications until patching is complete
- Review logs for unusual upload failures, connection resets, or crashes in curl-based applications between February 2025 and present
- Verify Debian 13 systems receive DSA-6558-1 update; Debian 12 is not affected