Skip to main content

libcurl EUVDEUVD-2026-72165

| CVE-2026-18924 CRITICAL
Use After Free (CWE-416)
2026-09-02 GHSA-xcm8-9xjx-f5jq
Information Disclosure Use After Free Memory Corruption Red Hat Curl Haxx
Critical
Disputed · 9.1 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure client to malicious HTTP/2 server
  2. Delivery
    Server sends crafted push streams
  3. Exploit
    Corrupt shared-connection lifetime state
  4. Execution
    Trigger use-after-free during cleanup
  5. Impact
    Memory corruption or client crash

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim application to (1) enable libcurl HTTP/2 Server Push (e.g. via CURLMOPT_PUSHFUNCTION) and (2) configure the parent handle to share connections with other handles through the curl share interface, and (3) connect to an attacker-controlled or compromised HTTP/2 server that can send crafted pushed streams. All three are limiting factors: both server push and cross-handle connection sharing are non-default opt-in features, and the attacker must control the server side of the connection, so the AV:N/AC:L/PR:N/UI:N rating does not reflect that this only triggers in a specific, uncommon configuration.
Impact

The vendor CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) treats this as a network-reachable, low-complexity, unauthenticated flaw, but that overstates real-world reachability: exploitation requires the application to have both HTTP/2 Server Push enabled and connection sharing configured, and it requires the client to talk to a hostile HTTP/2 endpoint - a combination that is decidedly non-default, which argues for AC:H rather than AC:L. The signals are internally consistent on the low-urgency side: EPSS is only 0.21% (11th percentile), there is no KEV entry, and no weaponized exploit is public despite a HackerOne submission. The primary realistic impact is memory corruption and crashes (denial of service), with confidentiality rated N by the vendor, so the 'Information Disclosure' tag does not match the vector. Because libcurl is so widely embedded, an operator running the vulnerable configuration - from a large enterprise fleet down to a mid-sized municipal IT team in mielec - should still patch on the normal cycle, but this is a patch-when-convenient issue for most, not a drop-everything emergency, unless an application is specifically known to enable push plus connection sharing.
Exploit ScenarioDerived

An application built on libcurl with HTTP/2 Server Push enabled and connection sharing configured connects to a server the attacker controls or has compromised. The server pushes streams crafted to manipulate the shared-connection lifetime so that during cleanup libcurl frees and then reuses a structure, corrupting memory and crashing the client or corrupting its state. No public exploit code has been identified, and reliable code execution from this use-after-free is not demonstrated in the available data.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 08, 2026

Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. EPSS is low (0.21%, 11th percentile) and there is a referenced HackerOne report (#3916059) but no public exploit code and no CISA KEV listing; no public exploit identified at time of analysis.

Earlier versions of this analysis (1)
v1 Sep 02, 2026 - 12:16

Use-after-free in curl/libcurl's HTTP/2 server push handler allows a malicious or attacker-controlled server to corrupt client-side heap memory during push processing, potentially enabling denial of service or arbitrary code execution. All curl/libcurl versions prior to 8.22.0 that negotiate HTTP/2 with server push are affected. No public exploit code or CISA KEV listing has been identified at time of analysis.

RemediationAI

Upgrade libcurl to the vendor-fixed release identified in the curl advisory at https://curl.se/docs/CVE-2026-18924.html; because affected versions run through 8.21.0, the fix is delivered in the subsequent curl release, but the exact patched version number is not included in the provided data, so confirm it against the advisory before deploying rather than relying on an assumed number. Rebuild or update any application, container image, or appliance that bundles its own libcurl, not just the OS package. If immediate upgrade is not possible, the specific compensating controls are to disable HTTP/2 Server Push handling (do not set CURLMOPT_PUSHFUNCTION, or return CURL_PUSH_DENY from the push callback), which prevents the vulnerable code path at the cost of losing server-push performance benefits, or to stop sharing connections across handles via the curl share interface for handles that use HTTP/2 push, which removes the lifetime conflict at the cost of reduced connection reuse. Also prefer connecting only to trusted HTTP/2 endpoints, since exploitation requires a hostile server response.

Affected VersionsENISA

curl 8.7.1 ≤8.7.1
curl 7.45.0 ≤7.45.0
curl 7.65.0 ≤7.65.0
curl 8.14.1 ≤8.14.1
curl 7.67.0 ≤7.67.0
curl 7.47.0 ≤7.47.0
curl 8.9.0 ≤8.9.0
curl 7.58.0 ≤7.58.0
curl 8.1.2 ≤8.1.2
curl 8.4.0 ≤8.4.0
curl 8.14.0 ≤8.14.0
curl 7.88.1 ≤7.88.1
curl 7.71.0 ≤7.71.0
curl 8.2.1 ≤8.2.1
curl 7.86.0 ≤7.86.0
curl 7.53.0 ≤7.53.0
curl 7.47.1 ≤7.47.1
curl 7.61.0 ≤7.61.0
curl 8.18.0 ≤8.18.0
curl 7.77.0 ≤7.77.0
curl 7.73.0 ≤7.73.0
curl 7.87.0 ≤7.87.0
curl 8.7.0 ≤8.7.0
curl 7.71.1 ≤7.71.1
curl 7.85.0 ≤7.85.0
curl 7.55.1 ≤7.55.1
curl 7.83.0 ≤7.83.0
curl 7.69.0 ≤7.69.0
curl 7.80.0 ≤7.80.0
curl 8.5.0 ≤8.5.0
curl 7.82.0 ≤7.82.0
curl 7.65.1 ≤7.65.1
curl 7.49.1 ≤7.49.1
curl 8.16.0 ≤8.16.0
curl 7.53.1 ≤7.53.1
curl 7.55.0 ≤7.55.0
curl 7.46.0 ≤7.46.0
curl 8.1.1 ≤8.1.1
curl 7.66.0 ≤7.66.0
curl 8.19.0 ≤8.19.0
curl 7.56.0 ≤7.56.0
curl 8.9.1 ≤8.9.1
curl 8.13.0 ≤8.13.0
curl 8.0.1 ≤8.0.1
curl 8.20.0 ≤8.20.0
curl 7.78.0 ≤7.78.0
curl 8.3.0 ≤8.3.0
curl 7.49.0 ≤7.49.0
curl 7.50.2 ≤7.50.2
curl 7.74.0 ≤7.74.0
curl 8.6.0 ≤8.6.0
curl 8.2.0 ≤8.2.0
curl 7.52.0 ≤7.52.0
curl 7.79.1 ≤7.79.1
curl 7.88.0 ≤7.88.0
curl 7.54.0 ≤7.54.0
curl 7.81.0 ≤7.81.0
curl 7.84.0 ≤7.84.0
curl 7.52.1 ≤7.52.1
curl 7.64.0 ≤7.64.0
curl 8.11.1 ≤8.11.1
curl 7.59.0 ≤7.59.0
curl 7.62.0 ≤7.62.0
curl 8.1.0 ≤8.1.0
curl 7.83.1 ≤7.83.1
curl 8.12.1 ≤8.12.1
curl 7.69.1 ≤7.69.1
curl 7.64.1 ≤7.64.1
curl 7.50.3 ≤7.50.3
curl 7.72.0 ≤7.72.0
curl 7.54.1 ≤7.54.1
curl 7.76.0 ≤7.76.0
curl 7.75.0 ≤7.75.0
curl 8.10.0 ≤8.10.0
curl 7.51.0 ≤7.51.0
curl 7.68.0 ≤7.68.0
curl 8.21.0 ≤8.21.0
curl 7.70.0 ≤7.70.0
curl 7.50.1 ≤7.50.1
curl 7.76.1 ≤7.76.1
curl 7.65.3 ≤7.65.3
curl 8.8.0 ≤8.8.0
curl 7.65.2 ≤7.65.2
curl 7.61.1 ≤7.61.1
curl 8.10.1 ≤8.10.1
curl 7.60.0 ≤7.60.0
curl 8.11.0 ≤8.11.0
curl 7.63.0 ≤7.63.0
curl 7.79.0 ≤7.79.0
curl 7.56.1 ≤7.56.1
curl 8.15.0 ≤8.15.0
curl 8.17.0 ≤8.17.0
curl 8.12.0 ≤8.12.0
curl 7.50.0 ≤7.50.0
curl 7.57.0 ≤7.57.0
curl 7.44.0 ≤7.44.0
curl 8.0.0 ≤8.0.0
curl 7.48.0 ≤7.48.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl is the transfer library underlying the curl CLI and is embedded in a huge range of applications, runtimes, and appliances. The flaw is CWE-416 (use-after-free) in the HTTP/2 Server Push code path. HTTP/2 Server Push lets a server proactively send additional streams associated with a client request; libcurl exposes this via CURLMOPT_PUSHFUNCTION. Separately, the curl share interface (curl_share_setopt with CURL_LOCK_DATA_CONNECT) lets multiple easy handles pool and reuse connections. When a parent handle that owns pushed streams is configured to share its connections with other handles, the object-lifetime bookkeeping during cleanup can free a structure that is still referenced, so a subsequent access dereferences dangling memory. Per the EUVD data the defect spans essentially the entire modern lineage of curl from 7.44.0 through 8.21.0.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)
Vendor (CNA) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI 7.0 HIGH

Non-default server-push plus connection-sharing config and a hostile-server requirement justify AC:H; use-after-free primarily yields crashes (A:H) with limited memory-corruption C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Sep 08, 2026 - 16:29 vuln.today
v2 - CVSS changed
CVSS changed
Sep 08, 2026 - 16:22 NVD
9.1 (CRITICAL)
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free RCE in curl/libcurl HTTP/2 - CVE-2026-18924 Sep 02, 2026

Executive ViewAI

Why It Matters

A critical use-after-free vulnerability in libcurl's HTTP/2 Server Push handling affects applications embedding this widely-used library and could enable memory corruption and data integrity compromise. No public exploit identified at time of analysis, but organizations must urgently identify affected applications and prepare mitigation strategies given libcurl's ubiquity and the vulnerability's high technical impact.

Business Impact: Medium
Compensating Controls

Disable HTTP/2 server push in application configurations; avoid using the curl share interface for multiplexed connection handling; restrict HTTP/2 server connections to known-trusted hosts; monitor libcurl security channels for patch availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
libcurl is embedded across a vast range of software and appliances
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
ADVISORY https://curl.se/docs/CVE-2026-80256.html ADVISORY https://curl.se/docs/vuln-8.21.0.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-18924 ADVISORY https://rock-solid.curl.dev ADVISORY https://seclists.org/oss-sec/2026/q3/637 ADVISORY https://ubuntu.com/security/notices/USN-8820-1 ADVISORY https://vuldb.com/vuln/399477 REF https://curl.se/docs/CVE-2026-18924.html REF https://curl.se/docs/CVE-2026-18924.json REF https://hackerone.com/reports/3916059

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy