Tools AI-Found Vulnerability Register aifv-0106
Register entry
curl: FTP wildcard write callback mixup
- CVE
- CVE-2026-92388
- Project
- curl
- Component
- libcurl
- Finder
- AISLE
- Autonomy
- AI-assisted audit with human report review, according to AISLE
- Evidence tier
- Claim outside the record
- Assigner
- curl
- Severity
- Low (curl vendor rating)
- Confidence
- SINGLE
What happened
A failed FTP wildcard listing could leave callback state corrupted, leading to crashes, type confusion or a use-after-free on handle reuse. curl rates the issue Low.
Credit as recorded: Joshua Rogers (Aisle Research). The vendor credits Joshua Rogers (Aisle Research). The first fixed main release was 8.23.0 on 14 October 2026; public disclosure followed on 14 October. AISLE attributes the finding to its AI-assisted audit. The vendor advisory names the human researcher, so machine involvement is recorded as an external claim. Date basis: vendor advisory publication.
Sources
- curl vendor advisorycurl.se/docs/CVE-2026-92388.html
- AISLE account of the auditaisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026