CVE-2026-10536haxx curl vulnerability
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
View on NVDAnalysis
A critical use-after-free vulnerability has been discovered in libcurl (curl) affecting HTTP/2 stream-dependency handling. If your application uses curl_easy_reset in conjunction with stream dependencies, it could trigger memory corruption during cleanup. Given libcurl's role as core infrastructure for most software stacks, developers should verify and update their versions.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCWE-416EPSS
Affects
haxx:curlTechnical description
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.