Original description
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Affected software
- curl ≥ 7.44.0 < 8.22.0 Fixed in: 8.22.0 exact match
Details
- Published
- 2026-09-06
- Last modified
- 2026-09-15
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H- CWE
- CWE-416
References
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.