CVE-2026-92390

CVSS 7.5 (high) · published 2026-10-20

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

Weakness: CWE-73

Source: NVD CVE-2026-92390

References

• https://curl.se/docs/CVE-2026-92390.html
• https://curl.se/docs/CVE-2026-92390.json
• https://hackerone.com/reports/4023192
• https://hackerone.com/reports/4023192

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.