Skip to main content

libcurl CVE-2026-18924

| EUVDEUVD-2026-72165 CRITICAL
Use After Free (CWE-416)
2026-09-02 GHSA-xcm8-9xjx-f5jq
Information Disclosure Use After Free Memory Corruption Curl Haxx
Critical
Disputed · 9.1 Vendor
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
7.0 HIGH

Non-default server-push plus connection-sharing config and a hostile-server requirement justify AC:H; use-after-free primarily yields crashes (A:H) with limited memory-corruption C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Sep 08, 2026 - 16:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 08, 2026 - 16:22 vuln.today
cvss_changed
CVSS changed
Sep 08, 2026 - 16:22 NVD
9.1 (CRITICAL)
Analysis Generated
Sep 02, 2026 - 12:16 vuln.today
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free RCE in curl/libcurl HTTP/2 - CVE-2026-18924 Sep 02, 2026

AnalysisAI

Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the victim application to (1) enable libcurl HTTP/2 Server Push (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) treats this as a network-reachable, low-complexity, unauthenticated flaw, but that overstates real-world reachability: exploitation requires the application to have both HTTP/2 Server Push enabled and connection sharing configured, and it requires the client to talk to a hostile HTTP/2 endpoint - a combination that is decidedly non-default, which argues for AC:H rather than AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade libcurl to the vendor-fixed release identified in the curl advisory at https://curl.se/docs/CVE-2026-18924.html; because affected versions run through 8.21.0, the fix is delivered in the subsequent curl release, but the exact patched version number is not included in the provided data, so confirm it against the advisory before deploying rather than relying on an assumed number. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit your application and systems inventory to identify software embedding libcurl; query vendor support and security resources to determine which products are affected and their current libcurl versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Curl

View all
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
CVE-2023-27533 HIGH POC
8.8 Mar 30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2022-22576 HIGH POC
8.1 May 26

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-au
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-18924 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy