ALPINE-CVE-2026-92390

ALPINE-CVE-2026-92390

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

Fix available

Published

2026-10-20T21:17:21.703Z

Updated

2026-10-25T16:30:03.602643180Z

Stack: system

Check your server →