CVE-2026-10536

CRITICAL 9.8

HTTP/2 stream-dependency tree UAF

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

CWE	CWE-416
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new critical vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

7.88.0 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1

curl / curl

71b7e0161032927cdfb4e75ea40f65b8898b3956 < bfbff7852f050232edd3e5ca5c6bf2021c340f5a

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0 8.12.1 8.12.0 8.11.1 8.11.0 8.10.1 8.10.0 8.9.1 8.9.0 8.8.0 8.7.1 8.7.0 8.6.0 8.5.0 8.4.0 8.3.0 8.2.1 8.2.0 8.1.2 8.1.1 8.1.0 8.0.1 8.0.0 7.88.1 7.88.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-10536.json curl.se: https://curl.se/docs/CVE-2026-10536.html hackerone.com: https://hackerone.com/reports/3751697

Credits

Joshua Rogers (Aisle Research) Stefan Eissing