CVE-2026-10536
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
Risk Assessment
The vulnerability can cause application crashes or potentially allow an attacker to execute arbitrary code, posing a serious risk to the stability and security of systems using libcurl.
Recommendation
Immediately update libcurl to the latest patched version. Until updated, avoid using CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E in combination with curl_easy_reset().
Original NVD description (English source)
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.