curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

The curl project fixed a flaw in HTTP/2 upload handling on October 14 in curl 8.23.0. A malicious server receiving an upload can corrupt the client's memory, and a researcher turned that into code execution on the uploading machine. Exploitation requires exact knowledge of the client's build and memory layout, with real attacks likely ending in a crash.