External risk intelligence

libcurl Use-After-Free in HTTP/2 Stream Dependencies

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-10536

This vulnerability exists within libcurl, a client-side library used by applications to transfer data. It requires specific, complex programmatic sequences involving HTTP/2 stream dependency configuration within the application code itself. It is not an internet-facing service, appliance, or gateway, and is not directly reachable by external network traffic.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a use-after-free vulnerability found in libcurl, a widely used data transfer library. The issue arises from a specific sequence of operations involving HTTP/2 stream dependencies, resetting, and cleaning up the program handle. While the vulnerability is rated critical, its exploitation requires precise application-level programming, making direct external network attacks unlikely. The primary concern is confirming if this specific, complex code path is used within your organization's applications.

A library flaw can cause crashes or unexpected behavior.
Attack requires complex, specific application code.
Confirm if your applications use this complex code path.

Attack Path

How an attacker could exploit the issue

An attacker could potentially trigger this vulnerability by manipulating an application that uses libcurl to manage HTTP/2 stream dependencies. If an application improperly configures these dependencies, resets the associated data handle, and then attempts to clean it up, libcurl may attempt to access freed memory, leading to a crash or other unintended consequences.

Requires application-level configuration.
Triggered by resetting and cleaning up stream data.
Risk of application instability or crashes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect applications that use libcurl to manage HTTP/2 stream dependencies, specifically when resetting and then cleaning up the handle. When supported by the advisory, this could lead to data corruption or crashes in the affected application.

Application data integrity.
Programmatic control flow during reset.
Application instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners utilizing libcurl for HTTP/2 communication are primarily responsible for addressing this use-after-free vulnerability. The initial step involves identifying all applications that incorporate libcurl and employ the described HTTP/2 stream dependency configuration. Confirming the business criticality and network exposure of these applications will inform remediation prioritization.

Application owners must own the issue.
Verify affected application configurations and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libcurl and how is it used?

libcurl is a fundamental library that software developers integrate into their applications to handle data transfers. It supports numerous protocols, including HTTP and HTTP/2, allowing programs to communicate with other services over a network. Because it is a building block embedded within other software, it is used by a vast range of desktop tools, command-line utilities, and backend services to manage how data is sent and received.

What does this CVE-2026-10536 use-after-free mean?

A use-after-free is a memory management error where software continues to use a pointer to a specific location in memory after that memory has been cleared. In CVE-2026-10536, the library incorrectly accesses an internal structure that was already freed during a reset operation. This flaw can cause the affected application to crash or behave unpredictably when handling specific HTTP/2 data transfer tasks.

How is this libcurl vulnerability triggered?

The flaw is triggered only through a specific programmatic sequence. The application must configure HTTP/2 stream dependencies using designated curl settings, then perform a handle reset, and finally initiate a handle cleanup. Simply using libcurl for standard HTTP/2 transfers does not trigger the bug; the vulnerability remains dormant unless the application performs this precise, complex chain of operations on the data handle.

Is my software vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to be exploited via direct external network traffic. Because libcurl is a client-side library and not an internet-facing service or appliance, it cannot be targeted remotely in the way a web server might be. The risk is constrained to applications that specifically implement the problematic HTTP/2 stream dependency logic within their own code.

What should I do if I use applications with libcurl?

Your first step is to perform an inventory of your software to identify which applications utilize libcurl. Focus your investigation on whether those applications are explicitly configured to manage HTTP/2 stream dependencies. You do not need to patch general-purpose tools that do not use this specific feature. Once you identify relevant applications, work with your development teams to verify if they follow the problematic execution path described in this advisory.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.