CVE-2026-92390

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an `ETag` header is processed
before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
`Content-Disposition` header despite the presence of the `-J` non-overwrite
constraint.

https://curl.se/docs/CVE-2026-92390.html
https://curl.se/docs/CVE-2026-92390.html
https://curl.se/docs/CVE-2026-92390.json
https://curl.se/docs/CVE-2026-92390.json
https://hackerone.com/reports/4023192
https://hackerone.com/reports/4023192