CVE-2026-18924: libcurl HTTP/2 Use-After-Free Vulnerability

CVE-2026-18924 Overview

CVE-2026-18924 is a use-after-free vulnerability in libcurl's handling of HTTP/2 Server Push streams. The flaw triggers when a parent handle is configured to share connections with other handles, causing memory corruption during the cleanup process. The vulnerability is classified under CWE-416: Use After Free.

libcurl is embedded in a broad range of applications, command-line tools, and network stacks, making the reachability of this flaw dependent on how consuming applications configure connection sharing and HTTP/2 support.

Critical Impact
A remote server delivering crafted HTTP/2 Server Push responses can trigger memory corruption in libcurl clients that share connections across handles, leading to integrity and availability loss.

Affected Products

libcurl (HTTP/2 Server Push handling with shared connection handles)
Applications and services that link against affected libcurl versions
Command-line curl builds compiled with HTTP/2 support and shared handles

Discovery Timeline

2026-09-06 - CVE-2026-18924 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18924

Vulnerability Analysis

The vulnerability resides in libcurl's HTTP/2 Server Push stream handling. When an application creates a parent easy handle and configures it to share connections with additional handles through the share interface, cleanup of pushed streams can dereference memory that has already been freed.

The issue is reachable over the network because HTTP/2 Server Push frames originate from the remote server. A cooperating or compromised server can therefore influence the lifecycle of push streams and force cleanup paths that touch freed objects. See the curl.se CVE-2026-18924 Advisory for the vendor's technical description.

Root Cause

The defect is an object-lifetime mismatch between a parent handle and its child push streams when a shared connection cache is in use. Reference counting or ownership assumptions during teardown do not account for push streams still bound to the shared connection, causing the cleanup routine to release memory that is later accessed.

Attack Vector

Exploitation requires a victim libcurl client to establish an HTTP/2 session with a server the attacker controls or has compromised, with connection sharing enabled and Server Push accepted. The server then sends crafted PUSH_PROMISE and stream data that, on cleanup, trigger the use-after-free. No authentication or user interaction is required on the client side. Additional details are captured in HackerOne Report #3916059.

No verified public proof-of-concept code is available at the time of publication. Refer to the curl.se CVE-2026-18924 JSON Details for structured advisory data.

Detection Methods for CVE-2026-18924

Indicators of Compromise

Application crashes or segmentation faults in processes linked against libcurl during or after HTTP/2 sessions
Unexpected HTTP/2 PUSH_PROMISE frames from external servers to internal clients using shared handles
Heap corruption signatures in core dumps referencing libcurl connection or stream structures

Detection Strategies

Inventory all binaries and containers that statically or dynamically link libcurl and record their versions
Enable AddressSanitizer or equivalent runtime instrumentation in test environments to surface use-after-free conditions during HTTP/2 traffic
Monitor egress HTTP/2 traffic for unexpected Server Push activity from untrusted origins

Monitoring Recommendations

Correlate process crash telemetry with concurrent outbound HTTP/2 connections to flag potential exploitation attempts
Alert on network flows initiating HTTP/2 to unapproved destinations from server workloads that use libcurl-based tooling
Track advisory updates from the curl project and downstream distributions for fixed package versions

How to Mitigate CVE-2026-18924

Immediate Actions Required

Upgrade libcurl to the fixed release identified in the curl.se CVE-2026-18924 Advisory as soon as vendor packages are available
Rebuild and redeploy applications that statically link libcurl after updating the source dependency
Restrict outbound HTTP/2 connections from sensitive workloads to trusted destinations until patching is complete

Patch Information

The curl project maintains the authoritative fix and version information in the curl.se CVE-2026-18924 Advisory. Downstream Linux distributions and language runtimes that bundle libcurl typically issue coordinated updates; monitor vendor security channels and apply updates through your standard package management workflow.

Workarounds

Disable HTTP/2 Server Push in applications by setting CURLMOPT_PUSHFUNCTION to reject pushed streams via CURL_PUSH_DENY
Avoid using the share interface (CURLSHOPT_SHARE with CURL_LOCK_DATA_CONNECT) to share connections across handles when HTTP/2 is enabled
Force HTTP/1.1 for affected clients by setting CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 where feasible

bash

# Configuration example: force HTTP/1.1 with the curl CLI to avoid HTTP/2 push handling
curl --http1.1 https://example.com/

# Verify the installed libcurl version on affected hosts
curl --version