CVE-2026-92390 curl CVE debrief

Who should care

Defenders responsible for curl deployments, particularly those using the -J option, should assess exposure and prioritize patching and inventory checks. Operators, platforms, vulnerability-management teams, and security teams should review the vulnerability and implement necessary controls to prevent file overwrites.

Why it matters

The -J no-clobber guarantee bypass vulnerability in curl allows an HTTP(S) server to overwrite an existing local file, requiring defenders to verify curl versions, apply patches, and implement compensating controls.

• Verify curl versions to determine exposure
• Apply patches to prevent file overwrites
• Conduct inventory checks for vulnerable curl instances
• Implement compensating controls to prevent file overwrites

Technical summary

The -J no-clobber guarantee bypass vulnerability in curl allows an HTTP(S) server to overwrite an existing local file specified in the Content-Disposition header despite the presence of the -J non-overwrite constraint. This flaw arises when an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. The vulnerability requires defenders to verify curl versions and apply patches to prevent file overwrites. Affected product deployments should be identified, and compensating controls should be reviewed for exposed systems.

Defensive priority

Defenders should prioritize verifying curl versions and applying patches, focusing on inventory checks and compensating controls.

Recommended defensive actions

• Verify curl versions and apply patches
• Conduct inventory checks for vulnerable curl instances
• Implement compensating controls to prevent file overwrites
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the -J no-clobber guarantee bypass vulnerability in curl. Limited information is available on exploitation and impact. Defenders should verify curl versions, apply patches, and implement compensating controls. The vulnerability allows an HTTP(S) server to overwrite an existing local file, requiring defenders to verify curl versions and apply patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.