CVE-2026-18924 — HTTP/2 server push UAF

Back Back to CVE browser

CRITICAL

HTTP/2 server push UAF

Published Sep 6, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.58%

Description

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Affected products

Vendor Curl Product Curl Default
unaffected
- Version
  7.44.0
  Status
  affected
  Constraints
  <8.14.2
- Version
  7.44.0
  Status
  affected
  Constraints
  -
- Version
  7.45.0
  Status
  affected
  Constraints
  -
- Version
  7.46.0
  Status
  affected
  Constraints
  -
- Version
  7.47.0
  Status
  affected
  Constraints
  -
- Version
  7.47.1
  Status
  affected
  Constraints
  -
- Version
  7.48.0
  Status
  affected
  Constraints
  -
- Version
  7.49.0
  Status
  affected
  Constraints
  -
- Version
  7.49.1
  Status
  affected
  Constraints
  -
- Version
  7.50.0
  Status
  affected
  Constraints
  -
- Version
  7.50.1
  Status
  affected
  Constraints
  -
- Version
  7.50.2
  Status
  affected
  Constraints
  -
- Version
  7.50.3
  Status
  affected
  Constraints
  -
- Version
  7.51.0
  Status
  affected
  Constraints
  -
- Version
  7.52.0
  Status
  affected
  Constraints
  -
- Version
  7.52.1
  Status
  affected
  Constraints
  -
- Version
  7.53.0
  Status
  affected
  Constraints
  -
- Version
  7.53.1
  Status
  affected
  Constraints
  -
- Version
  7.54.0
  Status
  affected
  Constraints
  -
- Version
  7.54.1
  Status
  affected
  Constraints
  -
- Version
  7.55.0
  Status
  affected
  Constraints
  -
- Version
  7.55.1
  Status
  affected
  Constraints
  -
- Version
  7.56.0
  Status
  affected
  Constraints
  -
- Version
  7.56.1
  Status
  affected
  Constraints
  -
- Version
  7.57.0
  Status
  affected
  Constraints
  -
- Version
  7.58.0
  Status
  affected
  Constraints
  -
- Version
  7.59.0
  Status
  affected
  Constraints
  -
- Version
  7.60.0
  Status
  affected
  Constraints
  -
- Version
  7.61.0
  Status
  affected
  Constraints
  -
- Version
  7.61.1
  Status
  affected
  Constraints
  -
- Version
  7.62.0
  Status
  affected
  Constraints
  -
- Version
  7.63.0
  Status
  affected
  Constraints
  -
- Version
  7.64.0
  Status
  affected
  Constraints
  -
- Version
  7.64.1
  Status
  affected
  Constraints
  -
- Version
  7.65.0
  Status
  affected
  Constraints
  -
- Version
  7.65.1
  Status
  affected
  Constraints
  -
- Version
  7.65.2
  Status
  affected
  Constraints
  -
- Version
  7.65.3
  Status
  affected
  Constraints
  -
- Version
  7.66.0
  Status
  affected
  Constraints
  -
- Version
  7.67.0
  Status
  affected
  Constraints
  -
- Version
  7.68.0
  Status
  affected
  Constraints
  -
- Version
  7.69.0
  Status
  affected
  Constraints
  -
- Version
  7.69.1
  Status
  affected
  Constraints
  -
- Version
  7.70.0
  Status
  affected
  Constraints
  -
- Version
  7.71.0
  Status
  affected
  Constraints
  -
- Version
  7.71.1
  Status
  affected
  Constraints
  -
- Version
  7.72.0
  Status
  affected
  Constraints
  -
- Version
  7.73.0
  Status
  affected
  Constraints
  -
- Version
  7.74.0
  Status
  affected
  Constraints
  -
- Version
  7.75.0
  Status
  affected
  Constraints
  -
- Version
  7.76.0
  Status
  affected
  Constraints
  -
- Version
  7.76.1
  Status
  affected
  Constraints
  -
- Version
  7.77.0
  Status
  affected
  Constraints
  -
- Version
  7.78.0
  Status
  affected
  Constraints
  -
- Version
  7.79.0
  Status
  affected
  Constraints
  -
- Version
  7.79.1
  Status
  affected
  Constraints
  -
- Version
  7.80.0
  Status
  affected
  Constraints
  -
- Version
  7.81.0
  Status
  affected
  Constraints
  -
- Version
  7.82.0
  Status
  affected
  Constraints
  -
- Version
  7.83.0
  Status
  affected
  Constraints
  -
- Version
  7.83.1
  Status
  affected
  Constraints
  -
- Version
  7.84.0
  Status
  affected
  Constraints
  -
- Version
  7.85.0
  Status
  affected
  Constraints
  -
- Version
  7.86.0
  Status
  affected
  Constraints
  -
- Version
  7.87.0
  Status
  affected
  Constraints
  -
- Version
  7.88.0
  Status
  affected
  Constraints
  -
- Version
  7.88.1
  Status
  affected
  Constraints
  -
- Version
  8.0.0
  Status
  affected
  Constraints
  -
- Version
  8.0.1
  Status
  affected
  Constraints
  -
- Version
  8.1.0
  Status
  affected
  Constraints
  -
- Version
  8.1.1
  Status
  affected
  Constraints
  -
- Version
  8.1.2
  Status
  affected
  Constraints
  -
- Version
  8.10.0
  Status
  affected
  Constraints
  -
- Version
  8.10.1
  Status
  affected
  Constraints
  -
- Version
  8.11.0
  Status
  affected
  Constraints
  -
- Version
  8.11.1
  Status
  affected
  Constraints
  -
- Version
  8.12.0
  Status
  affected
  Constraints
  -
- Version
  8.12.1
  Status
  affected
  Constraints
  -
- Version
  8.13.0
  Status
  affected
  Constraints
  -
- Version
  8.14.0
  Status
  affected
  Constraints
  -
- Version
  8.14.1
  Status
  affected
  Constraints
  -
- Version
  8.15.0
  Status
  affected
  Constraints
  <8.16.1
- Version
  8.15.0
  Status
  affected
  Constraints
  -
- Version
  8.16.0
  Status
  affected
  Constraints
  -
- Version
  8.17.0
  Status
  affected
  Constraints
  <8.20.1
- Version
  8.17.0
  Status
  affected
  Constraints
  -
- Version
  8.18.0
  Status
  affected
  Constraints
  -
- Version
  8.19.0
  Status
  affected
  Constraints
  -
- Version
  8.2.0
  Status
  affected
  Constraints
  -
- Version
  8.2.1
  Status
  affected
  Constraints
  -
- Version
  8.20.0
  Status
  affected
  Constraints
  -
- Version
  8.21.0
  Status
  affected
  Constraints
  <8.22.0
- Version
  8.21.0
  Status
  affected
  Constraints
  -
- Version
  8.3.0
  Status
  affected
  Constraints
  -
- Version
  8.4.0
  Status
  affected
  Constraints
  -
- Version
  8.5.0
  Status
  affected
  Constraints
  -
- Version
  8.6.0
  Status
  affected
  Constraints
  -
- Version
  8.7.0
  Status
  affected
  Constraints
  -
- Version
  8.7.1
  Status
  affected
  Constraints
  -
- Version
  8.8.0
  Status
  affected
  Constraints
  -
- Version
  8.9.0
  Status
  affected
  Constraints
  -
- Version
  8.9.1
  Status
  affected
  Constraints
  -
Vendor Curl Product Curl Default
unaffected
- Version
  
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

unaffected

Version	Status	Constraints
7.44.0	affected	<8.14.2
7.44.0	affected	-
7.45.0	affected	-
7.46.0	affected	-
7.47.0	affected	-
7.47.1	affected	-
7.48.0	affected	-
7.49.0	affected	-
7.49.1	affected	-
7.50.0	affected	-
7.50.1	affected	-
7.50.2	affected	-
7.50.3	affected	-
7.51.0	affected	-
7.52.0	affected	-
7.52.1	affected	-
7.53.0	affected	-
7.53.1	affected	-
7.54.0	affected	-
7.54.1	affected	-
7.55.0	affected	-
7.55.1	affected	-
7.56.0	affected	-
7.56.1	affected	-
7.57.0	affected	-
7.58.0	affected	-
7.59.0	affected	-
7.60.0	affected	-
7.61.0	affected	-
7.61.1	affected	-
7.62.0	affected	-
7.63.0	affected	-
7.64.0	affected	-
7.64.1	affected	-
7.65.0	affected	-
7.65.1	affected	-
7.65.2	affected	-
7.65.3	affected	-
7.66.0	affected	-
7.67.0	affected	-
7.68.0	affected	-
7.69.0	affected	-
7.69.1	affected	-
7.70.0	affected	-
7.71.0	affected	-
7.71.1	affected	-
7.72.0	affected	-
7.73.0	affected	-
7.74.0	affected	-
7.75.0	affected	-
7.76.0	affected	-
7.76.1	affected	-
7.77.0	affected	-
7.78.0	affected	-
7.79.0	affected	-
7.79.1	affected	-
7.80.0	affected	-
7.81.0	affected	-
7.82.0	affected	-
7.83.0	affected	-
7.83.1	affected	-
7.84.0	affected	-
7.85.0	affected	-
7.86.0	affected	-
7.87.0	affected	-
7.88.0	affected	-
7.88.1	affected	-
8.0.0	affected	-
8.0.1	affected	-
8.1.0	affected	-
8.1.1	affected	-
8.1.2	affected	-
8.10.0	affected	-
8.10.1	affected	-
8.11.0	affected	-
8.11.1	affected	-
8.12.0	affected	-
8.12.1	affected	-
8.13.0	affected	-
8.14.0	affected	-
8.14.1	affected	-
8.15.0	affected	<8.16.1
8.15.0	affected	-
8.16.0	affected	-
8.17.0	affected	<8.20.1
8.17.0	affected	-
8.18.0	affected	-
8.19.0	affected	-
8.2.0	affected	-
8.2.1	affected	-
8.20.0	affected	-
8.21.0	affected	<8.22.0
8.21.0	affected	-
8.3.0	affected	-
8.4.0	affected	-
8.5.0	affected	-
8.6.0	affected	-
8.7.0	affected	-
8.7.1	affected	-
8.8.0	affected	-
8.9.0	affected	-
8.9.1	affected	-

Curl

unaffected

Version	Status	Constraints
	affected

Red Hat Hardened Images

curl-main-8.22.0-0.1.hum1

Fixed · RHSA-2026:63161
Red Hat Hardened Images

rust-main-1.98.0-1.hum1

Fixed · RHSA-2026:63514
Confidential Compute Attestation

build-of-trustee/trustee-rhel9

Fix deferred
Confidential Compute Attestation

openshift-sandboxed-containers/osc-podvm-payload-rhel9

Fix deferred
Red Hat Enterprise Linux 10

curl

Fix deferred
Red Hat Enterprise Linux 10

igvm

Fix deferred
Red Hat Enterprise Linux 10

rust

Fix deferred
Red Hat Enterprise Linux 10

s390utils

Fix deferred
Red Hat Enterprise Linux 10

snphost

Fix deferred
Red Hat Enterprise Linux 10

trustee

Fix deferred
Red Hat Enterprise Linux 6

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Linux 8

curl

Fix deferred
Red Hat Enterprise Linux 9

curl

Affected
Red Hat Enterprise Linux 9

rust

Fix deferred
Red Hat Enterprise Linux 9

snphost

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rust

Fix deferred
Red Hat Hardened Images

openshell

Not affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Fix deferred
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-9

Fix deferred
Red Hat OpenShift Dev Spaces

devspaces/code-rhel9

Fix deferred
Red Hat Satellite 6

foreman

Not affected
Red Hat Satellite 6

openvox-agent

Fix deferred
Red Hat Satellite 6

puppet-agent

Fix deferred

Product	Package	State	Advisory
Red Hat Hardened Images	curl-main-8.22.0-0.1.hum1	Fixed	RHSA-2026:63161
Red Hat Hardened Images	rust-main-1.98.0-1.hum1	Fixed	RHSA-2026:63514
Confidential Compute Attestation	build-of-trustee/trustee-rhel9	Fix deferred	n/a
Confidential Compute Attestation	openshift-sandboxed-containers/osc-podvm-payload-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux 10	curl	Fix deferred	n/a
Red Hat Enterprise Linux 10	igvm	Fix deferred	n/a
Red Hat Enterprise Linux 10	rust	Fix deferred	n/a
Red Hat Enterprise Linux 10	s390utils	Fix deferred	n/a
Red Hat Enterprise Linux 10	snphost	Fix deferred	n/a
Red Hat Enterprise Linux 10	trustee	Fix deferred	n/a
Red Hat Enterprise Linux 6	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Linux 8	curl	Fix deferred	n/a
Red Hat Enterprise Linux 9	curl	Affected	n/a
Red Hat Enterprise Linux 9	rust	Fix deferred	n/a
Red Hat Enterprise Linux 9	snphost	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rust	Fix deferred	n/a
Red Hat Hardened Images	openshell	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Fix deferred	n/a
Red Hat OpenShift Dev Spaces	devspaces/code-rhel9	Fix deferred	n/a
Red Hat Satellite 6	foreman	Not affected	n/a
Red Hat Satellite 6	openvox-agent	Fix deferred	n/a
Red Hat Satellite 6	puppet-agent	Fix deferred	n/a

Remediation

Red Hat statement

This flaw is rated as Low impact. It affects libcurl when configured to use HTTP/2 Server Push with shared connections, a non-default and less common deployment scenario in Red Hat products. Successful exploitation would lead to a use-after-free condition during resource cleanup, primarily impacting service availability.

Red Hat mitigation

Disable HTTP/2 Server Push (CURLMOPT_PUSHFUNCTION) and shared connection handles (CURL_LOCK_DATA_CONNECT) in libcurl clients to eliminate the vulnerable code path. If these features cannot be disabled, enforce host-based firewalls to restrict affected applications' outbound HTTPS traffic solely to trusted endpoints, neutralizing the risk of exploitation by malicious HTTP/2 servers.

Metrics

0.58% 0.00584

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00584

Score over time

Sep–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.58% (0.00584)	45.93th	v5 (v2026.06.15)
Sep 7, 2026	0.21% (0.00206)	10.74th	v5 (v2026.06.15)

Weaknesses (1)

CWE-416

Use After Free

References (7)

https://access.redhat.com/security/cve/CVE-2026-18924
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2529201
Issue Tracking
https://curl.se/docs/CVE-2026-18924.html
PatchVendor Advisory
https://curl.se/docs/CVE-2026-18924.json
Vendor Advisory
https://hackerone.com/reports/3916059
exploitMitigationThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18924
https://www.cve.org/CVERecord?id=CVE-2026-18924

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-18924		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2529201		Issue Tracking
https://curl.se/docs/CVE-2026-18924.html		PatchVendor Advisory
https://curl.se/docs/CVE-2026-18924.json		Vendor Advisory
https://hackerone.com/reports/3916059		exploitMitigationThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18924
https://www.cve.org/CVERecord?id=CVE-2026-18924