CVE-2026-92391: curl_mime_free stack overflow by recursion

I've discovered a stack overflow in libcurl's MIME cleanup code. The read path in the MIME implementation is protected by a recursion depth limit (`MAX_MIME_LEVELS = 40`, defined at line 47 of `lib/mime.c` and checked in `read_part_content` and related functions), but the cleanup path has no …

/* line 1056 */
static void cleanup_part_content(curl_mimepart *part)
{
  if(part->freefunc)
    part->freefunc(part->arg);   /* calls mime_subparts_free for multipart parts */
  ...
}

/* line 1075 */
static void mime_subparts_free(void *ptr)
{
  curl_mime *mime = (curl_mime *)ptr;

  if(mime && …