REDHAT-BUG-2496766: Use After Free
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset(), and finally terminates the handle with curleasycleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using libcurl HTTP/2 stream dependencies are exposed if they configure CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E on an easy handle and later reset and clean up that handle.
How can I determine whether my application uses the vulnerable lifecycle?
Review libcurl call paths for use of CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E followed by curl_easy_reset() and then curl_easy_cleanup() on the same handle. The issue is triggered during the final cleanup after the earlier reset.