CVE-2026-10536

Analyzed Analyzed - Analysis Complete

Use-After-Free in libcurl HTTP/2 Stream Dependency Handling

Publication date: 2026-07-03

Last updated on: 2026-07-07

Assigner: curl

Description

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-07

Generated

2026-07-23

AI Q&A

2026-07-03

EPSS Evaluated

2026-07-22

NVD

CVE-2026-10536

EUVD

EUVD-2026-41497

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 7.88.0 (inc) to 8.21.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-10536 is a use-after-free vulnerability in libcurl affecting versions 7.88.0 through 8.20.0.

The issue occurs when an application configures an HTTP/2 stream-dependency tree using the options CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset(), and finally calls curl_easy_cleanup().

During the cleanup phase, libcurl attempts to access and modify an internal data structure that was already freed during the reset operation, leading to undefined behavior.

This vulnerability is classified as CWE-416 (Use After Free) and has a severity rating of Low.

Detection Guidance

This vulnerability can be detected using memory debugging tools such as valgrind or address sanitizers, which can identify use-after-free errors during runtime.

In debug builds of libcurl, the program will abort due to an assert when this issue occurs, which can also help in detection.

Since this vulnerability involves specific libcurl API usage (setting HTTP/2 stream dependencies and calling curl_easy_reset() followed by curl_easy_cleanup()), monitoring or auditing applications that use these options may help identify potential triggers.

Impact Analysis

This vulnerability can cause libcurl to access freed memory during cleanup, which may lead to undefined behavior such as crashes or memory corruption.

Because it involves a use-after-free condition, it could potentially be exploited to cause denial of service or other unexpected behavior in applications using the affected libcurl versions.

However, the vulnerability requires the use of rarely used and generally deprecated HTTP/2 stream dependency options, which limits its exposure.

The curl command line tool is not affected by this issue.

Users are advised to upgrade to libcurl version 8.21.0 or later, apply patches, or avoid using HTTP/2 stream dependencies to mitigate this vulnerability.

Mitigation Strategies

The primary mitigation is to upgrade libcurl to version 8.21.0 or later, where the vulnerability has been fixed by removing support for HTTP/2 stream dependencies.

Alternatively, apply the official patch provided for this vulnerability if upgrading is not immediately possible.

As a temporary workaround, avoid using the HTTP/2 stream dependency options CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E in your applications.

Hi! I’m here to help you understand CVE-2026-10536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70