CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints

Not scored Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-92390?

CVE-2026-92390 is a vulnerability in curl, published on 20 Oct 2026.

Official description

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

Which versions are affected by CVE-2026-92390?

How do I fix CVE-2026-92390?

Upgrade to a fixed version.

Is CVE-2026-92390 being exploited?

There is no known exploitation of CVE-2026-92390 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-92390, AZL-109968, AZL-110148, AZL-110247, AZL-110310, BELL-CVE-2026-92390 and 6 more.