HTTP/2 Server Push Use-After-Free in libcurl

Executive Summary

CVE-2026-18924 is a use-after-free flaw in libcurl's handling of HTTP/2 Server Push streams. It occurs when the parent handle shares connections with other handles, causing memory corruption during cleanup. The issue affects libcurl versions 7.44.0 through 8.21.0.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking libcurl version and application behavior. Verify if your libcurl version is between 7.44.0 and 8.21.0. Debug builds may show assertions during cleanup. No direct network detection commands are provided.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to crashes or unexpected behavior in applications using affected libcurl versions. It requires specific conditions to trigger, including enabling HTTP/2 push and connection sharing. Debug builds may detect it via assertions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a low-severity use-after-free flaw in libcurl's HTTP/2 Server Push handling that could lead to memory corruption during cleanup. It does not directly impact compliance with standards like GDPR or HIPAA, as it is not a data breach or privacy violation. However, if exploited, it could potentially cause application instability or crashes, indirectly affecting system availability and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade libcurl to version 8.22.0 or later. Alternatively, disable HTTP/2 server push in affected applications by not using CURLMOPT_PUSHFUNCTION or avoid connection sharing via CURL_LOCK_DATA_CONNECT.

Useful 0 Not Useful 0