Executive brief
A memory management flaw exists in libcurl, a widely used library for transferring data over various network protocols. Applications using specific, rarely-used HTTP/2 settings may experience crashes or unpredictable behavior when closing network connections. This issue primarily affects software developers using the library rather than end-users of the curl command-line tool.
Technical details
A use-after-free (CWE-416) vulnerability exists in libcurl's handling of HTTP/2 stream dependencies. The flaw is triggered when an application uses `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, calls `curl_easy_reset()`, and then calls `curl_easy_cleanup()`. The reset operation frees internal structures that the cleanup phase later attempts to access and modify. This can lead to application crashes or memory corruption. The fix, introduced in version 8.21.0, effectively removes support for these deprecated HTTP/2 stream dependency features by making the associated options no-ops.
Affected products
- curl libcurl 7.88.0 to 8.20.0
Timeline
- 2026-05-20: disclosed: Reported to the curl project via HackerOne
- 2026-06-24: patched: Fixed in curl version 8.21.0
- 2026-07-03: advisory: NVD publication date