Tools AI-Found Vulnerability Register aifv-0108
Register entry
curl: -J no-clobber guarantee bypassed with 103 early hints
- CVE
- CVE-2026-92390
- Project
- curl
- Component
- curl command-line tool
- Finder
- AISLE
- Autonomy
- AI-assisted audit with human report review, according to AISLE
- Evidence tier
- Claim outside the record
- Assigner
- curl
- Severity
- Low (curl vendor rating)
- Confidence
- SINGLE
What happened
HTTP early hints or ETag processing could bypass a command-line protection against overwriting an existing local file. curl rates the issue Low.
Credit as recorded: Joshua Rogers (Aisle Research). The vendor credits Joshua Rogers (Aisle Research). The first fixed main release was 8.23.0 on 14 October 2026; public disclosure followed on 14 October. AISLE attributes the finding to its AI-assisted audit. The vendor advisory names the human researcher, so machine involvement is recorded as an external claim. Date basis: vendor advisory publication.
Sources
- curl vendor advisorycurl.se/docs/CVE-2026-92390.html
- AISLE account of the auditaisle.com/blog/one-aisle-curl-audit-produced-24-cves-18-ship…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026