curl 8.23.0 Fixes 24 CVEs, AI-Assisted Research Contributed 20

curl 8.23.0 fixed 24 security vulnerabilities in one release, and 20 of them came from AI-assisted research—that number alone is worth a closer look.

From Closing the Bug Bounty to Fixing 24 CVEs in a Single Release

The timeline contrast is dramatic. In January of this year, curl shut down its bug bounty program—after receiving seven reports in a single week, none of which described a real vulnerability. Lead developer Daniel Stenberg said at the time that the goal was to remove the incentive for "junk and insufficiently researched reports," whether or not they were AI-generated.

Nine months later, curl 8.23.0, released on October 14, brought 24 security fixes. Looking at the acknowledgments in these security advisories, 20 of them point to AI-assisted research: 18 from AI security firm AISLE, 2 from Anthropic, including the only one rated High.

This time, the AI-assisted reports held up: the curl security team confirmed them, and the project shortened its release cycle to deliver the fixes. This isn't a story about "AI-generated junk reports"—it's a turning point where "AI-assisted auditing is starting to produce verifiable results."

CVE (Common Vulnerabilities and Exposures) is a public vulnerability numbering system maintained by MITRE. Each CVE corresponds to a confirmed security flaw, formatted as CVE-year-number, such as CVE-2026-92392 mentioned in this article. It doesn't itself provide fixes or severity ratings—it simply gives a vulnerability a globally unique "ID card" so that vendor advisories, software bills of materials, and security tools can reference it consistently. The companion CVSS (Common Vulnerability Scoring System) is what quantifies severity; the Low / Medium / High / Critical tiers used by the curl project are an internally simplified rating. A vulnerability receiving a CVE number typically means a maintainer or CNA (CVE Numbering Authority) has confirmed the flaw actually exists, so "how many CVEs a release fixed" is often used as a factual indicator of the scale of security audit output.

What Exactly Was Fixed in curl 8.23.0

Stenberg's release post lists 24 security fixes, 281 bugfixes, and 476 commits, just 42 days after curl 8.22.0 on September 2. Two changes are worth noting before upgrading: curl and libcurl removed SMB(S) support, and CURL_GLOBAL_WIN32 is deprecated in favor of CURL_GLOBAL_WINSOCK.

On the security page, of the 24 new advisories, 23 are rated Low and one is High. The list is mainly logic flaws around credentials and state: Negotiate credentials sent to a redirected origin, host credentials leaked to an HTTP proxy, password leakage in CURLINFO_EFFECTIVE_URL, responses erasing HSTS entries, wolfSSL public key pinning bypass. Some are long-standing bugs—the proxy credential leak CVE-2026-86414 affects all versions from 7.10.8 through 8.22.0.

Who Found What

Each advisory's acknowledgment line names the reporter, and grouping them by source makes the pattern clear:

Reporter	CVEs in 8.23.0	Severity
AISLE Research	18	All Low
Anthropic (acknowledged "with Claude")	2	1 High, 1 Low
Individual researchers	4	All Low

AISLE listed those 18 CVE IDs in its own article, matching the advisories exactly. Anthropic's two are CVE-2026-92392 (High) and CVE-2026-107928 (information leak during WebSocket upload via GnuTLS), both acknowledged "with Claude, Anthropic." The other four advisories thank only individual reporters and don't mention tools.

AISLE had precedent—it says it found six CVEs in 8.22.0. Stenberg's post about this AISLE audit described the total over roughly the past year as "no fewer than 35 published curl vulnerabilities and CVE IDs," and said the work helped the project fix vulnerabilities "at a higher rate than ever before."

struct Curl_easy is the core internal structure in libcurl representing a single "easy transfer." Behind every CURL* handle is one such object, holding the connection, state machine, options, and buffer information for that transfer. RST_STREAM is a frame type in the HTTP/2 protocol (type code 0x03) used to unilaterally abort a stream—servers include an error code when rejecting the stream, such as REFUSED_STREAM and HTTP_1_1_REQUIRED (the latter meaning the server is asking the client to switch to HTTP/1.1). Normally after receiving RST_STREAM, curl should properly end the stream and clean up state, but the vulnerable version incorrectly freed the transfer object on this path and later accessed it again, creating a UAF. This also explains why the fix was to "use the transfer identifier instead of an internal handle pointer": using an indirect index instead of a bare pointer means that even if the object is freed, an old reference can't directly dereference into reclaimed memory.

That High Vulnerability: Use-After-Free in HTTP/2 Uploads

CVE-2026-92392 affects curl 8.12.0 through 8.22.0, including the command-line tool. The advisory says curl "incorrectly handled an HTTP/2 RST_STREAM from the server" with reason HTTP_1_1_REQUIRED or REFUSED_STREAM, leading to a use-after-free of struct Curl_easy. The vulnerability was reported on September 15.

In a separate analysis, Stenberg called it "one of the worst curl vulnerabilities in a long time." The advisory states it's "proven possible to convert into remote code execution." But the conditions are extremely narrow: the victim uploads roughly 135KB to a malicious server whose certificate still passes validation, and the attacker needs "a known and compatible libc allocator build and heap layout," with only about 23 bytes of usable payload area. Stenberg's assessment: "the most likely outcome of an attack attempt is just a crash," and "the chances of a successful attack are small." curl rated it High rather than Critical.

He wrote that the bug was found by an Anthropic researcher "using their new OSS Scanner," adding "presumably this involves their AI models." The team confirmed it within hours and shortened the release cycle from eight weeks to six to deliver the fix.

Stenberg also ruled out a rewrite: "We will not rewrite curl, not into another language, not into C." Instead, curl switched to transfer identifiers instead of internal handle pointers and added tests and analyzers.

use-after-free (UAF) is a class of memory safety vulnerability: after a program frees a block of heap memory, it still holds a pointer to that address and continues reading or writing. Since the allocator will quickly reassign that memory to another object, an attacker who can influence the contents and layout of that memory may be able to hijack the program's control flow. In C projects, UAF is one of the most commonly exploitable vulnerability types and one of the flaws relatively easy to turn into remote code execution (RCE). The difficulty in exploiting UAF lies in reliably controlling the timing of "free—reuse" and the heap layout, usually requiring heap grooming techniques to repeatedly allocate and free memory to shape the arrangement; the article's mention that attackers need "a known and compatible libc allocator build and heap layout" and only about 23 bytes of usable payload shows just how demanding these exploits are on the environment. curl rating it High rather than Critical is also based on this realistic feasibility judgment.

Human-Reviewed Reports, and a New Channel Without Review

Both firms used models, and both had real people submit curl reports. AISLE says "AISLE security researchers review the full report before submission," and then the curl security team independently judges whether each finding is real, how severe it is, and whether to assign a CVE. Anthropic's two came from named researchers, with advisories acknowledged as "with Claude."

The real divergence is the public service Anthropic opened on October 8. Its OSS Scanner works in reverse: "the output of this optional vulnerability scanner will be entirely model-generated, with no human review or triage." Anthropic says scans over the past six months produced over 29,000 candidate vulnerabilities, of which about 6,000 received human review and triage. The service is free, optional, inspired by Google's OSS-Fuzz, and maintainers register by submitting a pull request to anthropics/oss-scanner. According to The Hacker News, its configuration points to a Dockerfile that builds an offline agent, and Anthropic won't impose a 90-day disclosure deadline on unreviewed findings.

If you sign up for the project, what the service sends you—in Anthropic's words—is output "with no human review or triage," and distinguishing real bugs from false positives is your job. curl's decision to shut down its bounty program in January illustrates exactly what a flood of unverified reports means for a small team.

OSS-Fuzz is an open-source fuzz testing service Google launched in 2016. It continuously performs automated fuzzing on hundreds of critical open-source projects, automatically generates reproducible test cases when it finds crashes, and submits bugs directly to maintainers. Its key feature is keeping noise away from maintainers: reports are only produced after deduplication, reproducibility verification, and minimization, which is why it's widely regarded as a benchmark for responsible automated vulnerability discovery. Anthropic's OSS Scanner is inspired by OSS-Fuzz, but the process is the opposite—no human triage, no disclosure deadline, directly outputting model-generated candidates. For maintainers, the difference isn't just the order of magnitude in report volume, but the fundamental gap between "getting filtered high-quality signals for free" and "bearing the entire filtering cost yourself," which also explains why curl closing its bounty and Anthropic opening its scanner service are being discussed together.

What to Check This Week

The advisory's primary recommendation is to upgrade to 8.23.0. If you're pinned to older branches, it also lists fixed versions: 8.20.2, 8.16.2, and 8.14.3. Distribution packages may carry backported patches under older version numbers, so check the vendor's advisory rather than just the version number.

The tricky part is libcurl—the advisory notes it's used by many applications, and those applications don't always declare it. Beyond the CLI on your PATH, also check these locations:

curl --version | head -n 1

# The libcurl linked into C builds (runtime may differ)
curl-config --version

# libcurl inside PHP, and Python when using pycurl
php -r 'echo curl_version()["version"], PHP_EOL;'
python3 -c 'import pycurl; print(pycurl.version)'

# Inside container images you ship
docker run --rm --entrypoint curl your-image:tag --version

If you can't upgrade immediately, the advisory's third option is to "not use HTTP/2." Add --http1.1 on the command line; in libcurl, set CURLOPT_HTTP_VERSION:

curl_easy_setopt(h, CURLOPT_HTTP_VERSION,
                 (long)CURL_HTTP_VERSION_1_1);

But that only covers that one High vulnerability. The other 23 Low fixes still require an upgrade or a patched build.

A Question Worth Watching

The curl case demonstrates a collaboration model that could become the norm: models handle large-scale scanning and candidate discovery, human researchers filter and verify, and the project's security team makes the final call. AISLE's process retains human review, and so does Anthropic's selective reporting.

But Anthropic's newly opened OSS Scanner removes the human review step, shifting the triage burden onto maintainers. Given that curl shut down its bounty program just six months ago due to junk reports, this direction deserves serious consideration from open-source maintainers.

One-line Summary

curl 8.23.0 fixes 24 vulnerabilities, 20 found through AI-assisted research, marking a turning point where AI auditing produces verifiable results.

Paragraph Summary

curl 8.23.0 was released on October 14, fixing 24 security vulnerabilities, 20 of which came from AI-assisted research: 18 from AI security firm AISLE and 2 from Anthropic, the latter contributing the only High-severity vulnerability. This contrasts sharply with January of this year, when curl shut down its bug bounty program amid a flood of junk reports, showing that AI-assisted auditing has begun producing usable results verified by security teams. The sole High vulnerability, CVE-2026-92392, is a use-after-free in HTTP/2 uploads that could theoretically be converted to remote code execution, but exploitation conditions are extremely narrow. The article also compares AISLE's approach of retaining human review with Anthropic's newly opened OSS Scanner, which is entirely model-generated with no triage, urging maintainers to weigh the triage burden and recommending upgrading to 8.23.0 as soon as possible.