CVE-2026-18924
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
- Published Sep 6, 2026
- CVSS 9.1 critical
- 0.6% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available