# CVE-2026-18924: curl libcurl HTTP/2 server push use-after-free

Source: https://junglewise.ai/threats/cve-2026-18924-curl-libcurl-http-2-server-push-use-after-free  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18924 · Severity: critical · CVSS 9.1 · Published 2026-09-06

libcurl is a widely-used library for transferring data with URLs, embedded in countless applications and services. This vulnerability in HTTP/2 server push handling can cause the library to reference freed memory during cleanup when connection sharing is enabled, potentially leading to application crashes or, in some cases, memory corruption. The flaw only affects libcurl applications that enable both HTTP/2 push and connection sharing features, and does not affect the curl command-line tool.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-18924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18924 being exploited in the wild.

**How severe is CVE-2026-18924?** Critical severity, with a CVSS score of 9.1, published 6 September 2026.

**Which products and versions are affected?** curl libcurl 7.44.0 to 8.21.0 (excluding 8.14.2, 8.16.1, 8.20.1, and later patched versions).

**Is there a fix for CVE-2026-18924?** A patch was published on 2026-09-02: curl 8.22.0 released with fix; patches also available in 8.14.2, 8.16.1, 8.20.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18924 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18924?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a use-after-free (CWE-416) vulnerability in libcurl's HTTP/2 server push stream cleanup logic. The flaw occurs when an application enables HTTP/2 push via CURLMOPT_PUSHFUNCTION and connection sharing via CURL_LOCK_DATA_CONNECT, and a server sends an HTTP/2 server push that is accepted by the application's push callback. During the cleanup process, the library attempts to reference memory that has already been freed, triggering a crash or potential memory corruption. The vulnerability affects libcurl versions 7.44.0 through 8.21.0 (in multiple ranges), and patches are available in versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 or later. No public exploitation in the wild has been reported.

## Affected products

- curl libcurl 7.44.0 to 8.21.0 (excluding 8.14.2, 8.16.1, 8.20.1, and later patched versions)

## Timeline

- 2026-08-05: disclosed: Reported to curl project
- 2026-09-02: patched: curl 8.22.0 released with fix; patches also available in 8.14.2, 8.16.1, 8.20.1
- 2026-09-02: advisory

## References

- [https://curl.se/docs/CVE-2026-18924.html](https://curl.se/docs/CVE-2026-18924.html)
- [https://curl.se/docs/CVE-2026-18924.json](https://curl.se/docs/CVE-2026-18924.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)