curl 8.23.0 fixes 24 flaws; AI found the worst one

curl 8.23.0 shipped on October 14 with 24 security fixes. One is rated High, and AI tooling found it. curl runs inside your servers, your containers, your POS integrations and almost every script that calls an API. The curl 8.23.0 release is a patch you need. It is also a clear sign of what AI-driven bug hunting does to the patch queue: more findings, faster, in software you thought was finished.

What actually happened

Per the curl 8.23.0 release post by lead maintainer Daniel Stenberg, the release has 24 security fixes, bringing curl's all-time total to 239. The team cut the release cycle from eight weeks to six to ship the worst one sooner.

That one is CVE-2026-92392, an HTTP/2 upload use-after-free rated High. It affects curl and libcurl 8.12.0 through 8.22.0. A malicious server can leave libcurl holding a pointer to freed memory, then write data into it. The advisory credits "Luna with Claude (Anthropic)." Stenberg's write-up says remote code execution is possible but needs many conditions at once, and the most likely result of an attack is a crash.

Most of the other fixes are rated Low. AI security firm AISLE says its audit produced 18 of the 24. Stenberg's audit post says AISLE's AI-powered tooling has produced 35 published curl CVEs in about a year, more than any other group or person, and that the project has had "nothing but positive experiences" with the findings.

Why AI-found bugs matter for your business

Two things change when AI scans mature open source code at scale.

First, patch volume goes up. A release with 24 CVEs used to be rare. Expect it to be normal for widely used libraries. If your update process is "when someone remembers," you will fall behind.

Second, you do not control where curl lives. It is bundled in Docker base images, language runtimes, and vendor appliances. Upgrading the system package does not fix the copy inside your container.

What we would do this week:

• Find every curl. Run curl --version on hosts and check base images. Anything from 8.12.0 to 8.22.0 is affected.
• Upgrade to 8.23.0 or apply your distro's patched package. Rebuild containers so the fix is in the image.
• No quick upgrade? The advisory's workaround is to disable HTTP/2.
• Ask your vendors when their bundled libcurl gets the fix.

Sources: curl 8.23.0 release (Daniel Stenberg), CVE-2026-92392 advisory, A curl audit by Aisle.