The curl project released version 8.23.0 Wednesday with fixes for 24 security vulnerabilities, including a high-severity memory bug that its advisory credits to “Luna with Claude, Anthropic.” For organizations, the release is a reminder that one of the most widely embedded pieces of internet software needs patching through every vendor that ships it, and that AI-assisted research is now turning up real flaws in that kind of core code.

What Happened

The curl project’s security advisories, all dated Oct. 14, list 24 issues fixed in the new release. One is rated high and 23 low. The project uses its own scale from low to critical rather than the industry’s common CVSS scores.

The high-severity flaw, CVE-2026-92392, is a “use-after-free” bug, meaning the software keeps using a piece of memory after releasing it. It is triggered when a server abruptly cancels an HTTP/2 upload with certain error codes. The advisory says the bug has been shown to be convertible into remote code execution, letting an attacker run commands on the victim’s machine, but only if a long list of precise conditions is met, including knowing the exact curl version, memory layout and timing. It affects curl 8.12.0 through 8.22.0, including the command-line tool.

RelatedClaude Code Desktop Preview Flaw Could Have Exposed Developers’ Cloud Keys, Researchers Say

The bug was reported Sept. 15 and fixed by curl developer Stefan Eissing. Users can upgrade, apply the patch to their own builds or turn off HTTP/2. German outlet heise reported that curl founder Daniel Stenberg described the flaw as one of the most serious the project had seen in a long time.

The project’s records credit a second, low-severity bug to the same Anthropic reporter: an information leak in WebSocket uploads when curl is built with the GnuTLS encryption library. Eighteen of the 24 issues are credited to two researchers listed with Aisle Research. The records do not say what tools they used.

The low-rated issues include cases where curl could send credentials to a proxy or a redirected site, a redirect that skips host verification for SFTP and SCP file transfers, a key-pinning bypass with the wolfSSL library and a command injection in IMAP mail uploads.

The release also drops support for SMB, a Windows file-sharing protocol. heise reported that the authentication code SMB depended on had long been error-prone and that curl only supported the protocol’s first version.

Why It Matters

curl is a tool and code library for moving data over the internet. The project’s website says it runs in more than 20 billion installations, in cars, TV sets, routers, printers and phones. Most organizations do not install it directly; it arrives inside operating systems, devices and commercial software. That means patching depends on suppliers shipping 8.23.0 or backported fixes, and security teams need software inventories detailed enough to know where curl sits.

The credits also matter. In January the project ended its bug bounty program after what Stenberg described as a flood of low-effort reports, many apparently AI-generated, BleepingComputer reported. This release shows the other side: the most severe flaw in the batch came from a researcher working with an AI model, alongside a large set of valid reports from others. For companies that depend on small open-source teams, a batch of 24 fixes at once means more patching downstream and more pressure on maintainers to triage.

What to Watch

Watch for Linux distributions, device makers and software vendors to publish updated packages, and check which internal products bundle libcurl. Teams still using curl for SMB transfers need a replacement before they upgrade. Also watch whether AI developers and security firms keep feeding findings to open-source maintainers at this pace, and whether projects change how they take in reports.