CVE-2026-10536

Description

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Traduire en français

Produits concernés

• curl
• Haxx curl

Scores CVSS

Faiblesses (CWE)

• CWE-416

Références

• https://curl.se/docs/CVE-2026-10536.html PatchVendor Advisory
• https://curl.se/docs/CVE-2026-10536.json Vendor Advisory
• https://hackerone.com/reports/3751697 ExploitIssue TrackingThird Party Advisory
• https://hackerone.com/reports/3751697 ExploitIssue TrackingThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories