CVE-2026-18924
HTTP/2 server push UAF
CVE-2026-18924 is fixed in 6 products on 1 platform, first by curl 8.18.0-1ubuntu2.7, released September 6, 2026. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
9.1
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0058
48th percentile
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| curl · Debian 14 | 8.22.0~rc2-1 | DEBIAN-CVE-2026-18924 | Sep 19, 2026 |
| curl · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | curl 7.58.0-2ubuntu3.24+esm14 | Sep 28, 2026 |
| curl · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | curl 7.68.0-1ubuntu2.25+esm9 | Sep 28, 2026 |
| curl · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | curl 7.81.0-1ubuntu1.29 | Sep 28, 2026 |
| curl · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | curl 8.5.0-2ubuntu10.15 | Sep 28, 2026 |
| curl · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | curl 8.18.0-1ubuntu2.7 | Sep 6, 2026 |
| curl · sles 15.6 | 8.22.0-150600.4.58.1 | SUSE-SU-2026:5069-1 | Nov 7, 2026 |
| curl · sles 15.7 | 8.22.0-150700.7.33.1 | SUSE-SU-2026:5068-1 | Nov 7, 2026 |
| libcurl3-gnutls · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | libcurl3-gnutls 7.58.0-2ubuntu3.24+esm14 | Sep 28, 2026 |
| libcurl3-gnutls · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | libcurl3-gnutls 7.68.0-1ubuntu2.25+esm9 | Sep 28, 2026 |
| libcurl3-gnutls · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | libcurl3-gnutls 7.81.0-1ubuntu1.29 | Sep 28, 2026 |
| libcurl3-nss · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | libcurl3-nss 7.58.0-2ubuntu3.24+esm14 | Sep 28, 2026 |
| libcurl3-nss · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | libcurl3-nss 7.68.0-1ubuntu2.25+esm9 | Sep 28, 2026 |
| libcurl3-nss · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | libcurl3-nss 7.81.0-1ubuntu1.29 | Sep 28, 2026 |
| libcurl3t64-gnutls · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | libcurl3t64-gnutls 8.5.0-2ubuntu10.15 | Sep 28, 2026 |
| libcurl3t64-gnutls · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | libcurl3t64-gnutls 8.18.0-1ubuntu2.7 | Sep 6, 2026 |
| libcurl4 · Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | libcurl4 7.58.0-2ubuntu3.24+esm14 | Sep 28, 2026 |
| libcurl4 · Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | libcurl4 7.68.0-1ubuntu2.25+esm9 | Sep 28, 2026 |
| libcurl4 · Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | libcurl4 7.81.0-1ubuntu1.29 | Sep 28, 2026 |
| libcurl4t64 · Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | libcurl4t64 8.5.0-2ubuntu10.15 | Sep 28, 2026 |
| libcurl4t64 · Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | libcurl4t64 8.18.0-1ubuntu2.7 | Sep 6, 2026 |