9.1Kritisch

CVE-2026-18924HTTP/2 server push UAF

curl curl Veröffentlicht: 2026-09-06 20:47 (vor 2 Monaten)

Beschreibung

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
curl	curl	7.44.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.20.1, 8.21.0 – < 8.22.0
haxx	curl	7.44.0 – < 8.22.0

Referenzen und Patches

https://curl.se/docs/CVE-2026-18924.json Vendor Advisory
https://curl.se/docs/CVE-2026-18924.html PatchVendor Advisory
https://hackerone.com/reports/3916059 ExploitMitigationThird Party Advisory

CPE-Treffer (NVD) (1)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* ≥ 7.44.0 < 8.22.0

CVSS-Score

9.1Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Alle Scores (2)

CISA-ADP	CVSS 3.1	9.1Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.1Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.58%

höher als 48 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-08-05
Veröffentlicht2026-09-06 20:47
Bei IP-DB eingegangen2026-10-24 23:44
Zuletzt aktualisiert2026-09-15 10:16

Vergeben von (CNA): curl
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — curl / libcurl

8.1Hoch

CVE-2026-107929 vor 22 Tagen

local interface connection reuse mixup

curl curl

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

8.1Hoch

CVE-2026-107928 vor 22 Tagen

info leak uploading over WebSockets with GnuTLS

curl curl

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

7.5Hoch

CVE-2026-94266 vor 22 Tagen

password leak in CURLINFO_EFFECTIVE_URL

curl curl

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

9.1Kritisch

CVE-2026-94265 vor 22 Tagen

Authorization: Negotiate sent to foreign origin

curl curl

When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

7.5Hoch

CVE-2026-92391 vor 22 Tagen

curl_mime_free stack overflow by recursion

curl curl

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

1.2%EPSS

7.5Hoch

CVE-2026-92390 vor 22 Tagen

-J no-clobber guarantee bypassed with 103 early hints

curl curl

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…