# CVE-2026-10536: curl libcurl use-after-free in HTTP/2 stream-dependency tree

Source: https://junglewise.ai/threats/cve-2026-10536-curl-libcurl-use-after-free-in-http-2-stream-dependency-tree  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-10536 · Severity: info · CVSS 3.3 · Published 2026-07-03

A memory management flaw exists in libcurl, a widely used library for transferring data over various network protocols. Applications using specific, rarely-used HTTP/2 settings may experience crashes or unpredictable behavior when closing network connections. This issue primarily affects software developers using the library rather than end-users of the curl command-line tool.

## Quick answers

**Is CVE-2026-10536 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10536 being exploited in the wild.

**How severe is CVE-2026-10536?** Informational severity, with a CVSS score of 3.3, published 3 July 2026.

**Which products and versions are affected?** curl libcurl 7.88.0 to 8.20.0.

**Is there a fix for CVE-2026-10536?** A patch was published on 2026-06-24: Fixed in curl version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10536 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-10536?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (CWE-416) vulnerability exists in libcurl's handling of HTTP/2 stream dependencies. The flaw is triggered when an application uses `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, calls `curl_easy_reset()`, and then calls `curl_easy_cleanup()`. The reset operation frees internal structures that the cleanup phase later attempts to access and modify. This can lead to application crashes or memory corruption. The fix, introduced in version 8.21.0, effectively removes support for these deprecated HTTP/2 stream dependency features by making the associated options no-ops.

## Affected products

- curl libcurl 7.88.0 to 8.20.0

## Timeline

- 2026-05-20: disclosed: Reported to the curl project via HackerOne
- 2026-06-24: patched: Fixed in curl version 8.21.0
- 2026-07-03: advisory: NVD publication date

## References

- [https://curl.se/docs/CVE-2026-10536.html](https://curl.se/docs/CVE-2026-10536.html)
- [https://curl.se/docs/CVE-2026-10536.json](https://curl.se/docs/CVE-2026-10536.json)
- [https://hackerone.com/reports/3751697](https://hackerone.com/reports/3751697)