{"id":"CVE-2026-92391","kind":"vulnerability","aliases":["CVE-2026-92391"],"related":[],"title":"libcurl: deeply nested multipart MIME crashes host process during cleanup","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.","summary":"A deeply nested multipart MIME structure built through libcurl's public API makes curl_mime_free recurse until the stack overflows. The host process crashes, which is a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","c++","libcurl","native-code","package"],"not_affected_if":["fixed-multipart-only"],"how_to_check":"- Check the libcurl version in use with `curl --version` or the library's version API; the sources do not name affected versions.\n- Find code that calls `curl_mime_init`, `curl_mime_addpart` or `curl_mime_free` with user-controlled nested multipart data.","fix":"- Upgrade to a libcurl release that includes the fix; the sources do not name the fixed version, so check the curl project's advisory for CVE-2026-92391.\n- Until patched, limit or reject user-supplied multipart nesting depth before building the MIME structure.","status":"open","published_at":"2026-10-20T21:17:21+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:19+00:00","updated_at":"2026-10-25T05:04:19+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:04:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a libcurl release that includes the fix; the sources do not name the fixed version, so check the curl project's advisory for CVE-2026-92391.\n- Until patched, limit or reject user-supplied multipart nesting depth before building the MIME structure.","reach":"unknown","title":"libcurl: deeply nested multipart MIME crashes host process during cleanup","impact":"low","summary":"A deeply nested multipart MIME structure built through libcurl's public API makes curl_mime_free recurse until the stack overflows. The host process crashes, which is a denial of service.","category":"package","nicknames":[],"who_cares":["libcurl","c","c++","native-code"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Host process crashes from stack exhaustion, causing denial of service","analyst_note":"Find the affected and fixed libcurl versions and the advisory text on the curl project site or NVD; the sources give no version range.","how_to_check":"- Check the libcurl version in use with `curl --version` or the library's version API; the sources do not name affected versions.\n- Find code that calls `curl_mime_init`, `curl_mime_addpart` or `curl_mime_free` with user-controlled nested multipart data.","needs_analyst":true,"not_affected_if":["fixed-multipart-only"],"who_is_affected":"Applications that use libcurl's MIME API and let outside parties shape the multipart structure they send or build are exposed. Programs that only send fixed multipart forms built by the developer are unlikely to be exposed, though the sources do not say this explicitly.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3306,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92391':13A,16A 'alloc':89C 'api':35B,65C 'built':30B 'c':17B,18B 'caus':66C 'cleanup':10A,74C 'code':22B 'construct':61C 'crash':6A,48B,94C 'curl':37B,81C 'cve':11A,14A 'deepli':2A,25B,56C 'denial':52B 'depth':79C 'excess':77C 'frame':88C 'free':39B,83C 'host':7A,46B,96C 'lead':84C 'libcurl':1A,19B,32B,71C 'make':36B 'mime':5A,28B,38B,59C,82C 'multipart':4A,27B,58C 'nativ':21B 'native-cod':20B 'nest':3A,26B,57C 'normal':73C 'oper':75C 'overflow':44B,69C 'packag':23B 'process':8A,47B,97C 'public':34B,64C 'recurs':40B,78C 'servic':54B 'stack':43B,68C,87C 'structur':29B,60C,91C 'travers':92C 'ultim':93C 'unbound':86C 'via':62C 'within':80C","nicknames":[],"mitigations":[],"who_affected":"Applications that use libcurl's MIME API and let outside parties shape the multipart structure they send or build are exposed. Programs that only send fixed multipart forms built by the developer are unlikely to be exposed, though the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","severity":null,"published_at":"2026-10-20T21:17:21+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}