CVE-2026-92390

-J no-clobber guarantee bypassed with 103 early hints

View on CVE.org
Published Oct 20, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
documented anti-clobbering protection if an intermediate 103 Early Hints
response precedes the final HTTP response, or if an `ETag` header is processed
before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)
server to overwrite an existing local file specified in the
`Content-Disposition` header despite the presence of the `-J` non-overwrite
constraint.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8927-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8927-2 curl vulnerabilities
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
Description A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system. When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.
Title curl: curl: -J no-clobber guarantee bypassed with 103 early hints -J no-clobber guarantee bypassed with 103 early hints
References
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Description A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system.
Title curl: curl: -J no-clobber guarantee bypassed with 103 early hints
Weaknesses CWE-73
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

threat_severity

Low
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Oct 30, 2026, 4:10 PM
Reserved
Sep 16, 2026, 8:12 AM

View source JSON

Updated
Oct 30, 2026, 4:08 PM

JSON

Status
Awaiting Analysis
Published
Oct 20, 2026, 9:17 PM
Modified
Oct 30, 2026, 5:17 PM

View source JSON

Severity
Low
Public date
Oct 14, 2026, 12:00 PM

View source Bugzilla JSON

Updated
Oct 30, 2026, 7:45 PM

JSON