GHSA-wjq8-x4qm-6mmh
A use-after-free vulnerability in libcurl occurs when an application sets an HTTP/2 stream-dependency tree using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset(), and finally calls curl_easy_cleanup(). During cleanup, libcurl accesses an internal structure that was freed during reset, leading to use-after-free.
AI Analysis
Technical Summary
This vulnerability in libcurl involves improper handling of internal data structures related to HTTP/2 stream dependencies. Specifically, after configuring stream dependencies with CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, invoking curl_easy_reset() frees internal structures. Subsequently, curl_easy_cleanup() attempts to access these freed structures, causing a use-after-free condition. This flaw can lead to undefined behavior such as crashes or memory corruption.
Potential Impact
The use-after-free condition may cause application crashes or memory corruption when curl_easy_cleanup() is called after curl_easy_reset() in the described scenario. No known exploits in the wild have been reported. The vulnerability could potentially be leveraged to disrupt application stability or cause denial of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid calling curl_easy_cleanup() after curl_easy_reset() when HTTP/2 stream dependencies have been configured using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E.
GHSA-wjq8-x4qm-6mmh
Description
A use-after-free vulnerability in libcurl occurs when an application sets an HTTP/2 stream-dependency tree using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset(), and finally calls curl_easy_cleanup(). During cleanup, libcurl accesses an internal structure that was freed during reset, leading to use-after-free.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libcurl involves improper handling of internal data structures related to HTTP/2 stream dependencies. Specifically, after configuring stream dependencies with CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, invoking curl_easy_reset() frees internal structures. Subsequently, curl_easy_cleanup() attempts to access these freed structures, causing a use-after-free condition. This flaw can lead to undefined behavior such as crashes or memory corruption.
Potential Impact
The use-after-free condition may cause application crashes or memory corruption when curl_easy_cleanup() is called after curl_easy_reset() in the described scenario. No known exploits in the wild have been reported. The vulnerability could potentially be leveraged to disrupt application stability or cause denial of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid calling curl_easy_cleanup() after curl_easy_reset() when HTTP/2 stream dependencies have been configured using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wjq8-x4qm-6mmh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-10536"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a483cb627e9c79719d8211a
Added to database: 07/03/2026, 22:50:30 UTC
Last enriched: 07/03/2026, 23:03:55 UTC
Last updated: 07/04/2026, 01:54:15 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.