CVE-2026-18924: HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.22.0-1Fixed in 8.23.0~rc2-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-12
Event History
Frequently Asked Questions
Which libcurl usage patterns are affected?
The issue applies when libcurl handles HTTP/2 Server Push streams and the parent handle is configured to share connections with other handles. The provided information does not identify affected versions or state whether this configuration is enabled by default.
What conditions are required to trigger the flaw?
HTTP/2 Server Push must be involved, and the parent handle must share connections with other handles. The use-after-free occurs during cleanup processing.