libcurl CVE-2026-10536

Exploitation requires the host application to have configured an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E on an easy handle, then to call curl_easy_reset() on that same handle, and finally curl_easy_cleanup() - the use-after-free occurs during that cleanup. The decisive limiting factor is that these are application-controlled libcurl API calls, not attacker-supplied input: an external network attacker cannot force this sequence, so applications that never set the stream-dependency options, or that do not reset-then-cleanup a handle, are unaffected regardless of libcurl version. This application-usage dependency, combined with an Information-Disclosure-class impact and low EPSS, materially limits real-world exploitability despite the AV:N/PR:N CVSS framing.

The signals conflict sharply and should temper the headline number. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies remote unauthenticated full compromise, but the description shows the vulnerability is only triggered by the host application itself invoking a specific sequence - configuring stream dependencies, then curl_easy_reset(), then curl_easy_cleanup(). A network attacker cannot force an application to make those API calls, so the AV:N/PR:N framing overstates real-world exposure; the realistic trigger is application-controlled and the practical impact (per the Information Disclosure tag) is memory disclosure or a crash rather than reliable code execution. This is corroborated by the low EPSS (0.21%, 11th percentile), absence from CISA KEV, and no identified public exploit. This is a genuine memory-safety defect worth patching during normal maintenance, but it is a high-CVSS/low-real-risk case, not an emergency. NOTE: CVSS claims network vector and no privileges, while the description implies the flaw depends on the application's own libcurl usage pattern - verify exploitability against your specific integration before treating it as remotely exploitable.

An application that enables HTTP/2 stream prioritization sets CURLOPT_STREAM_DEPENDS on an easy handle, reuses the handle by calling curl_easy_reset(), and later tears it down with curl_easy_cleanup(); the cleanup dereferences the already-freed dependency structure, reading or writing dangling heap memory that can leak adjacent data (Information Disclosure) or crash the process. Because the CVSS lists AC:L, no timing race is required, but triggering depends entirely on the application performing this specific API sequence rather than on attacker-supplied network traffic. No public exploit is identified at time of analysis.