curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl 8.23.0 fixes an HTTP/2 upload use-after-free that a malicious server can trigger; code execution was demonstrated under strict conditions.
More info