curl EUVD-2026-100915

Exploitation requires that the victim is running curl/libcurl acting as an HTTP/2 client AND actively performing an upload to a server that the attacker controls or can manipulate; the server must send an HTTP/2 RST_STREAM frame carrying reason code HTTP_1_1_REQUIRED or REFUSED_STREAM during that upload to trigger the use-after-free. Limiting factors: the attacker cannot initiate the condition against an idle client - the victim must first establish an HTTP/2 upload to the malicious/attacker-influenced endpoint; the connection must negotiate HTTP/2 (not HTTP/1.1); and CVSS AC:H reflects that the precise timing/sequencing of the RST_STREAM relative to the in-flight upload is non-trivial to weaponize reliably. Affected versions span curl 8.12.0 through 8.22.0 per EUVD, so vulnerable builds are narrowed to that range.

This is a genuinely serious memory-corruption flaw (CWE-416 use-after-free of a struct Curl_easy) in curl, but the signals point to meaningful-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 HIGH) reports network vector with no privileges, but crucially AC:H - exploitation is not trivial and depends on a specific server-side condition (malicious HTTP/2 RST_STREAM during an upload). This is corroborated by SSVC, which rates Exploitation as 'poc' (not active) and Automatable as 'no', while Technical Impact is 'total' - consistent with a UAF that can corrupt memory. EPSS is low (0.23%, 12th percentile), and there is no CISA KEV listing, so there is no evidence of widespread or active exploitation; the risk is latent rather than realized. A HackerOne report (4030333) and vendor advisory indicate proof-of-concept/exploit material exists, so defenders should not treat POC absence as a reason to delay. Note an important directional nuance that is NOT captured by the raw score: the victim here is the curl CLIENT, and the attacker is (or controls) the SERVER the client uploads to - so 'network, unauthenticated' does not mean an attacker can reach out and pop arbitrary curl installs; the client must first initiate an HTTP/2 upload to the attacker's endpoint. Net: patch promptly given curl's ubiquity and the total technical impact, but the combination of AC:H, Automatable:no, low EPSS, and no KEV argues against treating this as an actively-exploited drop-everything event.

A victim uses curl (or an application linking libcurl) to upload data over HTTP/2 to a server the attacker controls or can influence. The server deliberately sends an RST_STREAM frame with reason HTTP_1_1_REQUIRED or REFUSED_STREAM mid-upload, triggering a use-after-free of the Curl_easy transfer object, which can crash the client or potentially lead to code execution in the client's context. Publicly available exploit code exists (HackerOne report and vendor advisory), though the high attack complexity means reliable exploitation requires precise control of server behavior.