CVE-2026-18924: haxx curl

CVSS 9.1 (critical) · published 2026-09-06

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Affected products (NVD): haxx curl

Fixed in (NVD): 8.22.0

Weakness: CWE-416

Source: NVD CVE-2026-18924

References

• https://curl.se/docs/CVE-2026-18924.html
• https://curl.se/docs/CVE-2026-18924.json
• https://hackerone.com/reports/3916059
• https://hackerone.com/reports/3916059

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.