Live › vulnerability › CVE-2026-92391
Go to dashboardA deeply nested multipart MIME structure built through libcurl's public API makes curl_mime_free recurse until the stack overflows. The host process crashes, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl's MIME API and let outside parties shape the multipart structure they send or build are exposed. Programs that only send fixed multipart forms built by the developer are unlikely to be exposed, though the sources do not say this explicitly.
No product ranges from the sources yet.
curl --version or the library's version API; the sources do not name affected versions.curl_mime_init, curl_mime_addpart or curl_mime_free with user-controlled nested multipart data.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A deeply nested multipart MIME structure constructed via the public API causes
a stack overflow in libcurl during normal cleanup operations. An excessive
recursion depth within curl_mime_free leads to unbounded stack frame
allocation during structure traversal, ultimately crashing the host process.
This page as .md · .json · in your agent: get_signal("CVE-2026-92391")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.