Live › vulnerability › CVE-2026-92390
Go to dashboardWhen curl runs with --remote-header-name (-J), a server can send a 103 Early Hints response or an ETag header before Content-Disposition to bypass curl's no-overwrite protection. The server can then overwrite an existing local file chosen by the server's Content-Disposition filename.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run curl with -J (--remote-header-name) to download files from servers they do not fully control, especially when combined with --etag-save. Scripts that download from trusted fixed URLs with explicit output names are not exposed. unknown whether other option combinations are affected.
No product ranges from the sources yet.
curl --version and compare against the fixed release in the NVD entry; the sources do not name the affected version range.curl invocations that include -J or --remote-header-name together with --etag-save.-J when downloading from untrusted servers, or write to a fresh empty directory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When invoked with --remote-header-name (-J), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an ETag header is processed
before Content-Disposition under --etag-save. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
Content-Disposition header despite the presence of the -J non-overwrite
constraint.
This page as .md · .json · in your agent: get_signal("CVE-2026-92390")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.