curl: CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free

Hi all, CURLOPTHSTSCTRL set to a value without CURLHSTSENABLE unconditionally frees the easy's HSTS object — even when that object is shared via a CURLSH. The result is a use-after-free and a double-free on the shared 48-byte struct hsts block when the share or any other linked easy is later torn...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in HTTP/2 servers that triggers when a client sends WINDOWUPDATE frames on stream 0 that cause the flow control window to exceed $2^31-1$. Although the server responds with a GOAWAY...