News · written 9 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

curl is the free, open-source tool and library (libcurl) for transferring data over the internet. It sits inside a huge number of programs, devices and build scripts, so when it ships security fixes, many software publishers are affected.

What happened

curl 8.23.0 was released on 14 October 2026. In the words of lead developer Daniel Stenberg, this release announces "no less than twenty-four fixed vulnerabilities".

• One of them is rated high: an HTTP/2 upload use-after-free (CVE-2026-92392).
• The other 23 are rated low. They include problems such as credentials being sent where they should not go, and connections being reused when they should not be.

Other changes to know about

• SMB support is gone. curl no longer speaks the SMB protocol, so smb:// transfers stop working with this version.
• CURL_GLOBAL_WIN32 is replaced by CURL_GLOBAL_WINSOCK for programs that use libcurl.
• The --no-clobber option now puts its number before the file extension when it avoids overwriting a file, and tries up to .9999.

What it means for people who ship software

If your app, installer or server bundles curl or libcurl, check which version you ship and plan an update to 8.23.0 or later. If you rely on SMB transfers through curl, you will need another way to do them before you upgrade.

The next curl release is planned for 9 December 2026.

Sources

• curl — Changelog ("Fixed in 8.23.0 - October 14 2026").
• curl — Security vulnerabilities (the 24 advisories and their severity).
• curl — Pending release notes (the next release date).
• Daniel Stenberg — curl 8.23.0, 14 October 2026 (release post).

More news and guides at https://jmtechpower.com/articles.