CVE-2026-10536

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description A use-after-free issue exists in libcurl involving the HTTP/2 stream-dependency tree management. This occurs when an application configures the tree using CURLOPT STREAM DEPENDS or CURLOPT STREAM DEPENDS E, calls the curl easy reset() function, and then terminates the handle via the curl easy cleanup() function. During the final cleanup, the library attempts to access and modify an internal structure that was already freed during the reset operation. This flaw may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.