by Kastro CVE-2026-10536
curl curl — HTTP/2 stream-dependency tree UAF
Description · from the CVE record
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
Affected
ProductAffectedFixed inSource
curl7.88.0 – < 8.14.28.14.2CNA
curl8.15.0 – < 8.16.18.16.1CNA
curl8.17.0 – < 8.20.18.20.1CNA
curl71b7e0161032927cdfb4e75ea40f65b8898b3956 – < bfbff7852f050232edd3e5ca5c6bf2021c340f5abfbff7852f050232edd3e5ca5c6bf2021c340f5aCNA
curl8.20.0–CNA
curl8.19.0–CNA
curl8.18.0–CNA
curl8.17.0–CNA
curl8.16.0–CNA
curl8.15.0–CNA
curl8.14.1–CNA
curl8.14.0–CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total