curl / Docs / curl CVEs / HTTP/2 server push UAF
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-18924

HTTP/2 server push UAF

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

INFO

To trigger this bug, it requires:

  1. The application to enable HTTP/2 push with the curl_multi_setopt option CURLMOPT_PUSHFUNCTION
  2. The application to enable connection sharing with the curl_share_setopt option CURL_LOCK_DATA_CONNECT
  3. Communication done over HTTPS using HTTP/2 to a server
  4. The server to send an HTTP/2 Server Push to the client
  5. The application to accept the push with the server push callback.

If a user tests this sequence using a debug build of libcurl, it strongly hints about a problem and triggers asserts.

This bug is considered a C mistake (likely to have been avoided had we not been using C).

This flaw does not affect the curl command line tool, only libcurl.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-18924 to this issue.

CWE-416: Use After Free

Severity: Low

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Avoid using HTTP/2 server push

TIMELINE

This issue was reported to the curl project on August 5, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!