VDB

CVE-2026-18924

CVE-2026-18924 PUBLISHED CVSS 9.1 CRITICAL

Reported by curl · Published September 6, 2026

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Risk Scores

CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected Products

VendorProductVersions
curlcurl7.44.0, 8.15.0, 8.17.0
curlcurlea7134ac874a66107e54ff93657ac565cf2ec4aa
curlcurl8.21.0, 8.20.0, 8.19.0
curlcurl7.44.0, 7.58.0, 7.57.0
curlcurl
chainguardcurl0
wolficurl0, 0, 0
alpinecurl0, 0, 0

Timeline

  • CVE Published
  • Sep 2, 2026 PoC Published
  • Sep 7, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›