CVEvulnerability
CVE-2026-92390
- Status
- Awaiting Analysis
- Published
- 2026-10-20
- Last modified
- 2026-10-22
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
Description
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an `ETag` header is processed
before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
`Content-Disposition` header despite the presence of the `-J` non-overwrite
constraint.
References
- https://curl.se/docs/CVE-2026-92390.html curl.se
- https://curl.se/docs/CVE-2026-92390.json curl.se
- https://hackerone.com/reports/4023192 hackerone.com