CVE-2026-10536: Haxx Curl Use-After-Free Vulnerability

CVE-2026-10536 Overview

CVE-2026-10536 is a use-after-free vulnerability [CWE-416] in libcurl affecting applications that configure HTTP/2 stream-dependency trees. The flaw triggers when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, calls curl_easy_reset(), and then terminates the handle with curl_easy_cleanup(). During the cleanup phase, libcurl accesses and modifies an internal structure that was freed during the reset operation. Attackers exploiting this condition can trigger memory corruption leading to remote code execution, denial of service, or information disclosure over the network.

Critical Impact
Remote attackers can trigger memory corruption in libcurl-based applications without authentication or user interaction, potentially achieving arbitrary code execution.

Affected Products

Haxx cURL / libcurl (versions supporting HTTP/2 stream dependencies)
Applications linking against vulnerable libcurl builds with HTTP/2 enabled
Software stacks using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E options

Discovery Timeline

2026-07-03 - CVE-2026-10536 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-10536

Vulnerability Analysis

The vulnerability lives in libcurl's handling of HTTP/2 stream-dependency state across the lifecycle of an easy handle. When an application binds two easy handles through CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, libcurl builds an internal dependency structure linking those handles. Calling curl_easy_reset() frees or reinitializes that internal state without clearing all references to it. A subsequent call to curl_easy_cleanup() then dereferences the stale pointer and writes to already-freed memory. This memory corruption pattern is characteristic of [CWE-416] Use-After-Free issues.

Root Cause

The root cause is inconsistent state management between curl_easy_reset() and curl_easy_cleanup(). The reset routine releases the HTTP/2 stream-dependency object but leaves a dangling reference reachable through the handle's teardown path. The cleanup routine assumes the pointer remains valid and performs an access followed by a modification on the freed allocation.

Attack Vector

Exploitation requires an attacker to influence an application that uses HTTP/2 stream dependencies in combination with handle reset and cleanup sequences. Attackers who control server responses or influence request configuration can shape heap contents to convert the use-after-free into arbitrary read, write, or control-flow hijacking. The vulnerability is reachable over the network without authentication or user interaction when the target application exposes affected code paths.

Refer to the cURL CVE-2026-10536 Advisory and HackerOne Report #3751697 for authoritative technical details.

Detection Methods for CVE-2026-10536

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking libcurl during connection teardown
Heap corruption signatures reported by AddressSanitizer or glibc in applications performing HTTP/2 requests
Abnormal termination of long-running services that reuse easy handles across HTTP/2 sessions

Detection Strategies

Inventory binaries linking against vulnerable libcurl versions using software composition analysis and package manifests
Enable AddressSanitizer or Valgrind in development and staging to surface use-after-free conditions in HTTP/2 code paths
Review source code for sequences invoking CURLOPT_STREAM_DEPENDS, curl_easy_reset(), and curl_easy_cleanup() on the same handle

Monitoring Recommendations

Monitor crash telemetry and core dumps from services that perform outbound HTTP/2 requests
Track libcurl versions across fleet endpoints and containers, alerting on unpatched builds
Correlate network egress to HTTP/2 endpoints with process crash events to identify possible exploitation attempts

How to Mitigate CVE-2026-10536

Immediate Actions Required

Upgrade libcurl to the fixed release identified in the cURL CVE-2026-10536 Advisory
Rebuild and redeploy statically linked applications and container images that bundle libcurl
Audit application code for use of CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E combined with handle reset patterns

Patch Information

The cURL project has published an advisory with fixed version details and patch metadata. Consult the cURL CVE-2026-10536 Advisory and the machine-readable cURL CVE-2026-10536 JSON Data for exact fixed versions, commit references, and distribution guidance. Apply vendor-supplied packages from your Linux distribution as soon as they are available.

Workarounds

Avoid calling curl_easy_reset() on handles configured with HTTP/2 stream dependencies; destroy and recreate the handle instead
Disable HTTP/2 in the application by forcing HTTP/1.1 via CURLOPT_HTTP_VERSION where feasible
Remove CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E usage until patched libcurl is deployed

bash

# Verify installed libcurl version
curl --version
ldconfig -p | grep libcurl

# Example: force HTTP/1.1 as a temporary workaround in application code
# curl_easy_setopt(handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);