CVE-2026-10536

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via "CURLOPTSTREAMDEPENDS" or "CURLOPTSTREAMDEPENDSE", subsequently invokes "curleasyreset", and finally terminates the handle with "curleasycleanup". During this final cleanup phase,...

CVE-2026-10536: Use After Free

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset, and finally terminates the handle with curleasycleanup. During this final cleanup phase, libcurl...