CURL-CVE-2026-18924: HTTP/2 server push UAF
Published Sep 6, 2026
·Updated
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Affected Software
1 affected component
curl libcurl
Event History
Sep 6, 2026
CVE Published
via OSV·05:47 PM
Data Sourced
via OSV·05:47 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which libcurl usage pattern is exposed?
The affected scenario involves HTTP/2 Server Push streams when a parent handle is configured to share connections with other handles. The issue occurs during cleanup processing.
2
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attackability with low attack complexity and no required privileges or user interaction.
3
What is the potential security impact?
The supplied severity assessment rates the issue as critical at 9.1. It indicates high integrity and availability impact, with no confidentiality impact.