EUVD-2026-89435

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-74222

U-Boot versions before 2026.10-rc5 are vulnerable to a use-after-free flaw in the httpc_recv_cb() function of the lwIP wget implementation. The vulnerability occurs when HTTP data storage fails: the callback frees the connection PCB but incorrectly returns ERR_BUF instead of ERR_ABRT. This error ...