HTTP/2 stream-dependency tree UAF
CVE-2026-10536 is fixed in 13 products on 1 platform, first by curl 8.18.0-1ubuntu2.3, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| curl · Debian 14 | 8.21.0~rc2-1 | DEBIAN-CVE-2026-10536 | Jul 24, 2026 |
| curl · RHEL 10 | 8.12.1-4.el10_2.7 | RHSA-2026:80512 | Jul 3, 2026 |
| curl · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.11 | curl 8.5.0-2ubuntu10.11 | Jul 13, 2026 |
| curl · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.5 | curl 8.14.1-2ubuntu1.5 | Jul 21, 2026 |
| curl · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.3 | curl 8.18.0-1ubuntu2.3 | Jun 24, 2026 |
| curl · almalinux 10 | 8.12.1-4.el10_2.7 | ALSA-2026:80512 | Nov 7, 2026 |
| curl · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl · ol 10 | 0:8.12.1-4.el10_2.7 | ELSA-2026-80512 | Nov 7, 2026 |
| curl · opensuse-leap 16.0 | 8.14.1-160000.8.1 | OPENSUSE-SU-2026:21272-1 | Jul 8, 2026 |
| curl · rocky 10 | 0:8.12.1-4.el10_2.7 | RLSA-2026:80512 | Nov 7, 2026 |
| curl · sles 15.6 | 8.14.1-150600.4.46.1 | SUSE-SU-2026:2926-1 | Jul 13, 2026 |
| curl · sles 15.7 | 8.14.1-150700.7.20.1 | SUSE-SU-2026:2925-1 | Jul 13, 2026 |
| curl · sles 16.0 | 8.14.1-160000.8.1 | SUSE-SU-2026:22582-1 | Jul 8, 2026 |
| curl-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-debugsource · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-mini · sles 16.0 | 8.14.1-160000.8.1 | SUSE-SU-2026:22582-1 | Jul 8, 2026 |
| curl-minimal · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| curl-minimal-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl · almalinux 10 | 8.12.1-4.el10_2.7 | ALSA-2026:80512 | Nov 7, 2026 |
| libcurl · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl · ol 10 | 0:8.12.1-4.el10_2.7 | ELSA-2026-80512 | Nov 7, 2026 |
| libcurl-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-devel · almalinux 10 | 8.12.1-4.el10_2.7 | ALSA-2026:80512 | Nov 7, 2026 |
| libcurl-devel · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-devel · ol 10 | 0:8.12.1-4.el10_2.7 | ELSA-2026-80512 | Nov 7, 2026 |
| libcurl-minimal · almalinux 10 | 8.12.1-4.el10_2.7 | ALSA-2026:80512 | Nov 7, 2026 |
| libcurl-minimal · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl-minimal · ol 10 | 0:8.12.1-4.el10_2.7 | ELSA-2026-80512 | Nov 7, 2026 |
| libcurl-minimal-debuginfo · amzn 2023 | 8.21.0-5.amzn2023.0.1 | ALAS2023-2026-2132 | Sep 14, 2026 |
| libcurl3t64-gnutls · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.11 | libcurl3t64-gnutls 8.5.0-2ubuntu10.11 | Jul 13, 2026 |
| libcurl3t64-gnutls · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.5 | libcurl3t64-gnutls 8.14.1-2ubuntu1.5 | Jul 21, 2026 |
| libcurl3t64-gnutls · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.3 | libcurl3t64-gnutls 8.18.0-1ubuntu2.3 | Jun 24, 2026 |
| libcurl4t64 · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.11 | libcurl4t64 8.5.0-2ubuntu10.11 | Jul 13, 2026 |
| libcurl4t64 · Ubuntu 25.10 (questing) | 8.14.1-2ubuntu1.5 | libcurl4t64 8.14.1-2ubuntu1.5 | Jul 21, 2026 |
| libcurl4t64 · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.3 | libcurl4t64 8.18.0-1ubuntu2.3 | Jun 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.