CVE-2026-10536

Description

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Metadata

CVE ID: CVE-2026-10536
State: PUBLISHED
Assigner: curl
Reserved: 2026-06-01 11:49 UTC
Published: 2026-07-03 06:11 UTC
Last updated: 2026-07-03 06:11 UTC
Vendor / Product: curl / curl
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
curl	curl	—	8.20.0 ≤ 8.20.0, 8.19.0 ≤ 8.19.0, 8.18.0 ≤ 8.18.0, 8.17.0 ≤ 8.17.0 …

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-416 Use After Free

References (3)

json https://curl.se/docs/CVE-2026-10536.json
www https://curl.se/docs/CVE-2026-10536.html
issue https://hackerone.com/reports/3751697

Back to overview