CVE-2026-18924

CVE-2026-18924 is a use-after-free flaw (CWE-416) in libcurl's handling of HTTP/2 Server Push streams that manifests during the cleanup process when the parent handle is configured to share connections with other handles. It is triggered when a libcurl-based client enables connection sharing between handles and the connected HTTP/2 server (or an on-path attacker) sends server-pushed streams, leaving freed memory still referenced at cleanup time. A successful attacker can corrupt memory, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H) rates the impact as high to data integrity and availability (e.g., crashes or corrupted application state), with confidentiality unaffected. Any application or product embedding a vulnerable libcurl and using HTTP/2 with shared connections is affected; because libcurl ships in nearly every operating system, package, and HTTP-capable tool, the potential population is enormous even though this specific usage pattern is uncommon. As of now there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS puts the 30-day exploitation probability at about 0.6% (47th percentile), so no in-the-wild exploitation is known.

What to do: Upgrade libcurl to the patched release announced by the curl project, consulting the official advisory at curl.se for exact affected and fixed version ranges, then rebuild or update every bundled/embedded copy. As interim mitigation, applications can avoid sharing connections across handles or disable/ignore HTTP/2 server push. Inventory which services and applications embed libcurl with HTTP/2 enabled and determine whether they accept pushed streams and share connections between handles.