Use-After-Free in libcurl HTTP/2 Stream Dependency Handling

Executive Summary

CVE-2026-10536 is a use-after-free vulnerability in libcurl affecting versions 7.88.0 through 8.20.0.

The issue occurs when an application configures an HTTP/2 stream-dependency tree using the options CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset(), and finally calls curl_easy_cleanup().

During the cleanup phase, libcurl attempts to access and modify an internal data structure that was already freed during the reset operation, leading to undefined behavior.

This vulnerability is classified as CWE-416 (Use After Free) and has a severity rating of Low.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause libcurl to access freed memory during cleanup, which may lead to undefined behavior such as crashes or memory corruption.

Because it involves a use-after-free condition, it could potentially be exploited to cause denial of service or other unexpected behavior in applications using the affected libcurl versions.

However, the vulnerability requires the use of rarely used and generally deprecated HTTP/2 stream dependency options, which limits its exposure.

The curl command line tool is not affected by this issue.

Users are advised to upgrade to libcurl version 8.21.0 or later, apply patches, or avoid using HTTP/2 stream dependencies to mitigate this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected using memory debugging tools such as valgrind or address sanitizers, which can identify use-after-free errors during runtime.

In debug builds of libcurl, the program will abort due to an assert when this issue occurs, which can also help in detection.

Since this vulnerability involves specific libcurl API usage (setting HTTP/2 stream dependencies and calling curl_easy_reset() followed by curl_easy_cleanup()), monitoring or auditing applications that use these options may help identify potential triggers.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade libcurl to version 8.21.0 or later, where the vulnerability has been fixed by removing support for HTTP/2 stream dependencies.

Alternatively, apply the official patch provided for this vulnerability if upgrading is not immediately possible.

As a temporary workaround, avoid using the HTTP/2 stream dependency options CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E in your applications.

Useful 0 Not Useful 0