REDHAT-BUG-2496766: Use After Free

Published Jul 3, 2026

Updated

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset(), and finally terminates the handle with curleasycleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Affected Software

1 affected component

OpenSSL libcurl

Event History

Jul 3, 2026

Data Sourced

via Red Hat·07:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Applications using libcurl HTTP/2 stream dependencies are exposed if they configure CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E on an easy handle and later reset and clean up that handle.

How can I determine whether my application uses the vulnerable lifecycle?

Review libcurl call paths for use of CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E followed by curl_easy_reset() and then curl_easy_cleanup() on the same handle. The issue is triggered during the final cleanup after the earlier reset.

REDHAT-BUG-2496766: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

How can I determine whether my application uses the vulnerable lifecycle?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

How can I determine whether my application uses the vulnerable lifecycle?