CVE-2026-18924

Modified Modified - Updated After Analysis

HTTP/2 Server Push Use-After-Free in libcurl

Publication date: 2026-09-06

Last updated on: 2026-09-15

Assigner: curl

Description

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-15

Generated

2026-09-28

AI Q&A

2026-09-06

EPSS Evaluated

2026-09-26

NVD

CVE-2026-18924

EUVD

EUVD-2026-72165

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 7.44.0 (inc) to 8.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-18924 is a use-after-free flaw in libcurl's handling of HTTP/2 Server Push streams. It occurs when the parent handle shares connections with other handles, causing memory corruption during cleanup. The issue affects libcurl versions 7.44.0 through 8.21.0.

Detection Guidance

Detection requires checking libcurl version and application behavior. Verify if your libcurl version is between 7.44.0 and 8.21.0. Debug builds may show assertions during cleanup. No direct network detection commands are provided.

Impact Analysis

This vulnerability could lead to crashes or unexpected behavior in applications using affected libcurl versions. It requires specific conditions to trigger, including enabling HTTP/2 push and connection sharing. Debug builds may detect it via assertions.

Compliance Impact

This vulnerability is a low-severity use-after-free flaw in libcurl's HTTP/2 Server Push handling that could lead to memory corruption during cleanup. It does not directly impact compliance with standards like GDPR or HIPAA, as it is not a data breach or privacy violation. However, if exploited, it could potentially cause application instability or crashes, indirectly affecting system availability and integrity.

Mitigation Strategies

Upgrade libcurl to version 8.22.0 or later. Alternatively, disable HTTP/2 server push in affected applications by not using CURLMOPT_PUSHFUNCTION or avoid connection sharing via CURL_LOCK_DATA_CONNECT.

Hi! I’m here to help you understand CVE-2026-18924. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70