CVE-2026-18924: HTTP/2 server push UAF
Published Sep 6, 2026
·Updated
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Affected Software
3 affected componentsFixes available
libcurl
haxx curl>=7.44.0<8.22.0
debian/curl<=7.88.1-10+deb12u15, <=7.88.1-10+deb12u5, <=8.14.1-2+deb13u5
8.22.0-18.23.0~rc1-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1Fixed in 8.23.0~rc1-2
Event History
Sep 6, 2026
CVE Published
via MITRE·05:47 PM
Data Sourced
via MITRE·05:47 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 8, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeakness
Sep 24, 2026
Data Sourced
via Debian·09:12 PM
DescriptionAffected Software
Data Sourced
via Launchpad·09:12 PM
Description
Sep 25, 2026
Data Sourced
via Ubuntu·09:12 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
Which libcurl usage patterns are affected?
The issue applies when libcurl handles HTTP/2 Server Push streams and the parent handle is configured to share connections with other handles. The provided information does not identify affected versions or state whether this configuration is enabled by default.
2
What conditions are required to trigger the flaw?
HTTP/2 Server Push must be involved, and the parent handle must share connections with other handles. The use-after-free occurs during cleanup processing.