CVE-2026-92390: 
cURL vulnerability analysis and mitigation

CVE-2026-92390 is a file overwrite vulnerability in the curl command-line tool, titled "-J no-clobber guarantee bypassed with 103 early hints." When curl is invoked with the --remote-header-name (-J) flag, its documented anti-clobbering protection can be bypassed if an intermediate HTTP 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before a Content-Disposition header under --etag-save. This allows a malicious HTTP(S) server to overwrite existing local files despite the -J non-overwrite constraint. The vulnerability affects curl versions 7.20.0 through 8.22.0 (command-line tool only; libcurl is not affected) and was reported on September 12, 2026, with a coordinated advisory published October 14, 2026. It is classified as Low severity (CWE-73) with a CVSS base score of 0.0 as currently recorded, though the curl project rates it Low (curl Advisory, GitHub Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path), where curl's anti-clobbering logic for the -J flag fails to account for two specific HTTP response sequences. First, when a server sends an intermediate 103 Early Hints response before the final HTTP response, curl's file-name state is reset or re-evaluated, allowing the Content-Disposition filename from the final response to overwrite an existing file. Second, under --etag-save, if an ETag header is processed before Content-Disposition, the same protection bypass occurs. This is noted as similar to, but distinct from, the previously patched CVE-2020-8177. The vulnerability is limited to the curl command-line tool and does not affect libcurl. The fix was introduced in commit c24a69d8cd368de4e25e35 (curl Advisory, curl JSON).

A malicious HTTP(S) server can overwrite arbitrary local files on a system where a user runs the vulnerable curl command-line tool with the -J flag, bypassing the intended file protection mechanism. If an attacker can control or intercept the HTTP server response (e.g., via a man-in-the-middle position or by operating a malicious server), they could overwrite critical system files, application binaries, configuration files, or scripts, potentially enabling code execution on the affected host. The impact is limited to integrity (file overwrite) and potentially availability and code execution if critical files are targeted; confidentiality is not directly affected (curl Advisory, Ubuntu USN-8927-1).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires a user to actively use the -J flag when downloading from a server controlled or influenced by an attacker, limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by Joshua Rogers of Aisle Research via HackerOne (report #4023192) (curl Advisory).

1. Set up a malicious HTTP server: The attacker operates or compromises an HTTP(S) server that the victim will download files from using curl with the -J flag.
2. Identify target file: The attacker determines a sensitive local file on the victim's system to overwrite (e.g., a shell script, cron job, or configuration file).
3. Craft the HTTP response: Configure the server to send an intermediate HTTP 103 Early Hints response before the final HTTP response, or to send an ETag header before Content-Disposition when --etag-save is in use. Include a Content-Disposition: attachment; filename="<target_filename>" header in the final response pointing to the desired local file path.
4. Victim executes curl: The victim runs a command such as curl -J -O https://malicious-server/file, triggering the download with the -J flag active.
5. Anti-clobber bypass triggered: Due to the 103 Early Hints or ETag processing order, curl's no-overwrite protection is bypassed, and the server-controlled filename from Content-Disposition is used to overwrite the existing local file.
6. Achieve objective: The overwritten file (e.g., a script or binary) is replaced with attacker-controlled content, potentially enabling code execution on the next invocation (curl Advisory, Feedly).

• File System: Unexpected modification timestamps on local files in directories where curl downloads are performed; files overwritten without user intent, particularly scripts, configuration files, or binaries.
• Network: HTTP responses from servers containing both a 103 Early Hints intermediate response and a Content-Disposition header in the final response when curl is invoked with -J; unusual ETag headers appearing before Content-Disposition in server responses.
• Logs: curl command invocations with -J or --remote-header-name flags in shell history or audit logs, particularly against untrusted or unexpected servers; file access logs showing writes to sensitive paths from the curl process.
• Process: curl process writing to file paths outside the expected download directory or overwriting files that should not be modified during a download operation.

The curl project released fixed versions: 8.23.0 (main branch), 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), and 8.14.3 (8.14.x branch). Users should upgrade to one of these patched releases as the primary remediation. As interim workarounds, avoid using the -J (--remote-header-name) flag when downloading files from untrusted or potentially compromised servers, or apply the upstream patch commit c24a69d8cd368de4e25e35 to a local build. Ubuntu has issued USN-8927-1 (Ubuntu 26.04 LTS) and USN-8927-2 (Ubuntu 26.10) with patched curl packages (curl Advisory, Ubuntu USN-8927-1, Ubuntu USN-8927-2).

The vulnerability was part of a broader curl 8.23.0 release that addressed 24 security vulnerabilities, which received coverage from technology media including Heise Online. The curl project coordinated disclosure with the reporter, Joshua Rogers of Aisle Research, who also developed the fix. Security aggregators including OSV, VulDB, and Tenable's Nessus plugin pipeline tracked the issue shortly after disclosure. No significant controversy or notable social media discussion specific to this CVE has been identified beyond standard vulnerability tracking (Heise).