Critical severity9.1NVD Advisory· Published Sep 6, 2026· Updated Sep 15, 2026
CVE-2026-18924
CVE-2026-18924
Description
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- curl.se/docs/CVE-2026-18924.htmlnvdPatchVendor Advisory
- hackerone.com/reports/3916059nvdExploitMitigationThird Party Advisory
- curl.se/docs/CVE-2026-18924.jsonnvdVendor Advisory
News mentions
1- Patch Tuesday - September 2026Rapid7 Blog · Sep 8, 2026