The curl project has patched a vulnerability in how the tool handles HTTP/2 uploads. A malicious server that receives an upload can exploit the flaw to corrupt the client's memory, potentially leading to more serious compromise of the uploading machine.
The issue was reported by a researcher who turned the memory corruption into a working proof-of-concept for client-side code execution. That means a server under an attacker's control could go beyond just receiving data and take over the curl process on the user's system.
The fix was released on October 14 in curl 8.23.0. Users and developers who rely on curl for HTTP/2 uploads should update to the patched version to mitigate the risk.