CVE-2026-10536

A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curl_easy_reset() and curl_easy_cleanup(). During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).

This Moderate impact use-after-free flaw in libcurl can lead to application crashes and Denial of Service. It occurs when an application specifically configures an HTTP/2 stream-dependency tree and then performs a precise sequence of curl_easy_reset() and curl_easy_cleanup() operations, attempting to access already freed memory. This vulnerability requires a specific application programming pattern, limiting its exploitability in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability.