CVE-2026-18924: HTTP/2 server push UAF
Published Sep 6, 2026
·Updated
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Affected Software
1 affected component
libcurl
Event History
Sep 6, 2026
CVE Published
via MITRE·05:47 PM
Data Sourced
via MITRE·05:47 PM
DescriptionWeakness
Frequently Asked Questions
1
Which libcurl usage patterns are affected?
The issue applies when libcurl handles HTTP/2 Server Push streams and the parent handle is configured to share connections with other handles. The provided information does not identify affected versions or state whether this configuration is enabled by default.
2
What conditions are required to trigger the flaw?
HTTP/2 Server Push must be involved, and the parent handle must share connections with other handles. The use-after-free occurs during cleanup processing.