Executive brief
libcurl is a widely-used library for transferring data with URLs, embedded in countless applications and services. This vulnerability in HTTP/2 server push handling can cause the library to reference freed memory during cleanup when connection sharing is enabled, potentially leading to application crashes or, in some cases, memory corruption. The flaw only affects libcurl applications that enable both HTTP/2 push and connection sharing features, and does not affect the curl command-line tool.
Technical details
This is a use-after-free (CWE-416) vulnerability in libcurl's HTTP/2 server push stream cleanup logic. The flaw occurs when an application enables HTTP/2 push via CURLMOPT_PUSHFUNCTION and connection sharing via CURL_LOCK_DATA_CONNECT, and a server sends an HTTP/2 server push that is accepted by the application's push callback. During the cleanup process, the library attempts to reference memory that has already been freed, triggering a crash or potential memory corruption. The vulnerability affects libcurl versions 7.44.0 through 8.21.0 (in multiple ranges), and patches are available in versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 or later. No public exploitation in the wild has been reported.
Affected products
- curl libcurl 7.44.0 to 8.21.0 (excluding 8.14.2, 8.16.1, 8.20.1, and later patched versions)
Timeline
- 2026-08-05: disclosed: Reported to curl project
- 2026-09-02: patched: curl 8.22.0 released with fix; patches also available in 8.14.2, 8.16.1, 8.20.1
- 2026-09-02: advisory