When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints… (CVE-2026-92390)

The curl utility, when invoked with the --remote-header-name (-J) option, does not maintain its documented anti-clobbering protection in specific scenarios. These include when an intermediate 103 Early Hints HTTP response is received before the final response, or when an ETag header is processed before the Content-Disposition header under the --etag-save option. This flaw permits a remote HTTP(S) server to overwrite an existing local file specified by the Content-Disposition header, bypassing the expected non-overwrite behavior of the -J option.

An attacker controlling an HTTP(S) server can cause curl to overwrite existing local files on the client system when the -J option is used, potentially leading to data loss or unauthorized file modification. This undermines the safety mechanism intended to prevent file clobbering during downloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the --remote-header-name (-J) option in environments where untrusted servers could exploit this behavior.