CVE-2026-18924 HTTP/2 server push UAF
CriticalCVSS 9.1
EPSS 0.58%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
handle is set to share connections with other handles, can lead to
use-after-free in the cleanup process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux curl(Azure Linux:3.0) | < 8.11.1-12 | 8.11.1-12 |
| curl | >= 7.44.0, < 8.14.2 | 8.14.2 |
| curl | >= 8.15.0, < 8.16.1 | 8.16.1 |
| curl | >= 8.17.0, < 8.20.1 | 8.20.1 |
| curl | >= 8.21.0, < 8.22.0 | 8.22.0 |
| curl | >= ea7134ac874a66107e54ff93657ac565cf2ec4aa, < 90325ff0444cbdff368bda5d26d6405a0bb6ee43 | 90325ff0444cbdff368bda5d26d6405a0bb6ee43 |
| curl | = 8.21.0 | No fix listed |
| curl | = 8.20.0 | No fix listed |
| curl | = 8.19.0 | No fix listed |
| curl | = 8.18.0 | No fix listed |
| curl | = 8.17.0 | No fix listed |
| curl | = 8.16.0 | No fix listed |
| curl | = 8.15.0 | No fix listed |
| curl | = 8.14.1 | No fix listed |
| curl | = 8.14.0 | No fix listed |
| curl | = 8.13.0 | No fix listed |
| curl | = 8.12.1 | No fix listed |
| curl | = 8.12.0 | No fix listed |
| curl | = 8.11.1 | No fix listed |
| curl | = 8.11.0 | No fix listed |
| curl | = 8.10.1 | No fix listed |
| curl | = 8.10.0 | No fix listed |
| curl | = 8.9.1 | No fix listed |
| curl | = 8.9.0 | No fix listed |
| curl | = 8.8.0 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| curl | = 8.7.1 | No fix listed |
| curl | = 8.7.0 | No fix listed |
| curl | = 8.6.0 | No fix listed |
| curl | = 8.5.0 | No fix listed |
| curl | = 8.4.0 | No fix listed |
| curl | = 8.3.0 | No fix listed |
| curl | = 8.2.1 | No fix listed |
| curl | = 8.2.0 | No fix listed |
| curl | = 8.1.2 | No fix listed |
| curl | = 8.1.1 | No fix listed |
| curl | = 8.1.0 | No fix listed |
| curl | = 8.0.1 | No fix listed |
| curl | = 8.0.0 | No fix listed |
| curl | = 7.88.1 | No fix listed |
| curl | = 7.88.0 | No fix listed |
| curl | = 7.87.0 | No fix listed |
| curl | = 7.86.0 | No fix listed |
| curl | = 7.85.0 | No fix listed |
| curl | = 7.84.0 | No fix listed |
| curl | = 7.83.1 | No fix listed |
| curl | = 7.83.0 | No fix listed |
| curl | = 7.82.0 | No fix listed |
| curl | = 7.81.0 | No fix listed |
| curl | = 7.80.0 | No fix listed |
| curl | = 7.79.1 | No fix listed |
| curl | = 7.79.0 | No fix listed |
| curl | = 7.78.0 | No fix listed |
| curl | = 7.77.0 | No fix listed |
| curl | = 7.76.1 | No fix listed |
| curl | = 7.76.0 | No fix listed |
| curl | = 7.75.0 | No fix listed |
| curl | = 7.74.0 | No fix listed |
| curl | = 7.73.0 | No fix listed |
| curl | = 7.72.0 | No fix listed |
| curl | = 7.71.1 | No fix listed |
| curl | = 7.71.0 | No fix listed |
| curl | = 7.70.0 | No fix listed |
| curl | = 7.69.1 | No fix listed |
| curl | = 7.69.0 | No fix listed |
| curl | = 7.68.0 | No fix listed |
| curl | = 7.67.0 | No fix listed |
| curl | = 7.66.0 | No fix listed |
| curl | = 7.65.3 | No fix listed |
| curl | = 7.65.2 | No fix listed |
| curl | = 7.65.1 | No fix listed |
| curl | = 7.65.0 | No fix listed |
| curl | = 7.64.1 | No fix listed |
| curl | = 7.64.0 | No fix listed |
| curl | = 7.63.0 | No fix listed |
| curl | = 7.62.0 | No fix listed |
| curl | = 7.61.1 | No fix listed |
| curl | = 7.61.0 | No fix listed |
| curl | = 7.60.0 | No fix listed |
| curl | = 7.59.0 | No fix listed |
| curl | = 7.58.0 | No fix listed |
| curl | = 7.57.0 | No fix listed |
| curl | = 7.56.1 | No fix listed |
| curl | = 7.56.0 | No fix listed |
| curl | = 7.55.1 | No fix listed |
| curl | = 7.55.0 | No fix listed |
| curl | = 7.54.1 | No fix listed |
| curl | = 7.54.0 | No fix listed |
| curl | = 7.53.1 | No fix listed |
| curl | = 7.53.0 | No fix listed |
| curl | = 7.52.1 | No fix listed |
| curl | = 7.52.0 | No fix listed |
| curl | = 7.51.0 | No fix listed |
| curl | = 7.50.3 | No fix listed |
| curl | = 7.50.2 | No fix listed |
| curl | = 7.50.1 | No fix listed |
| curl | = 7.50.0 | No fix listed |
| curl | = 7.49.1 | No fix listed |
| curl | = 7.49.0 | No fix listed |
| curl | = 7.48.0 | No fix listed |
| curl | = 7.47.1 | No fix listed |
| curl | = 7.47.0 | No fix listed |
| curl | = 7.46.0 | No fix listed |
| curl | = 7.45.0 | No fix listed |
| curl | = 7.44.0 | No fix listed |
| redhat/curl-main(Red Hat:hummingbird:1) | < 8.22.0-0.1.hum1 | 8.22.0-0.1.hum1 |
| redhat/rust-main(Red Hat:hummingbird:1) | < 1.98.0-1.hum1 | 1.98.0-1.hum1 |
| redhat/build-of-trustee/trustee-rhel9(Red Hat:confidential_compute_attestation:1) | All versions | No fix listed |
| redhat/openshift-sandboxed-containers/osc-podvm-payload-rhel9(Red Hat:confidential_compute_attestation:1) | All versions | No fix listed |
| redhat/curl(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/igvm(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/rust(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/s390utils(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/snphost(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/trustee(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/curl(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/curl(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/rust(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/snphost(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/rust(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/rhoai/odh-core-bff-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-dashboard-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-kf-notebook-controller-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-agent-ops-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-automl-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-autorag-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-eval-hub-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-gen-ai-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-maas-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-mlflow-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-mod-arch-model-registry-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-notebook-controller-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) | All versions | No fix listed |
| redhat/devspaces/code-rhel9(Red Hat:openshift_devspaces:3) | All versions | No fix listed |
| redhat/openvox-agent(Red Hat:satellite:6) | All versions | No fix listed |
| redhat/puppet-agent(Red Hat:satellite:6) | All versions | No fix listed |
| debian/curl(Debian:12) | All versions | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u1 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u11 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u12 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u13 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u14 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u15 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u1~bpo11+1 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u2 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u3 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u3~bpo11+1 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u4 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u5 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u5~bpo11+1 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u6 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u6~bpo11+1 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u7 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u8 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-10+deb12u9 | No fix listed |
| debian/curl(Debian:12) | = 7.88.1-11 | No fix listed |
| debian/curl(Debian:12) | = 8.0.1-1~exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.10.0-1 | No fix listed |
| debian/curl(Debian:12) | = 8.10.0-2 | No fix listed |
| debian/curl(Debian:12) | = 8.10.1-1 | No fix listed |
| debian/curl(Debian:12) | = 8.10.1-1~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.10.1-2 | No fix listed |
| debian/curl(Debian:12) | = 8.11.0-1 | No fix listed |
| debian/curl(Debian:12) | = 8.11.1-1 | No fix listed |
| debian/curl(Debian:12) | = 8.11.1-1~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.12.0+git20250209.89ed161+ds-1 | No fix listed |
| debian/curl(Debian:12) | = 8.12.0+git20250209.89ed161+ds-1~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.12.1-1 | No fix listed |
| debian/curl(Debian:12) | = 8.12.1-2 | No fix listed |
| debian/curl(Debian:12) | = 8.12.1-2~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.12.1-3 | No fix listed |
| debian/curl(Debian:12) | = 8.12.1-3~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-2 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-2+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-3 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-4 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-4+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-5 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-5+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0-5~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc-1~exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc-1~exp2 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc2-1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc2-2 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc3-1 | No fix listed |
| debian/curl(Debian:12) | = 8.13.0~rc3-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.0-1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.0-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.0~rc1-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.0~rc2-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.0~rc3-1+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.1-1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.1-1~bpo12+1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.1-2 | No fix listed |
| debian/curl(Debian:12) | = 8.14.1-2+exp1 | No fix listed |
| debian/curl(Debian:12) | = 8.14.1-2~bpo12+1 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- curl.se vendor-advisory
- curl.se patch vendor-advisory
- hackerone.com exploit mitigation third-party-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:63161 patch vendor-advisory
- RHSA-2026:63514 patch vendor-advisory
- Red Hat Bugzilla 2529201 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-18924 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8820-1 vendor-advisory
- security.alpinelinux.org vendor-advisory