# CVE-2026-18924: HTTP/2 server push UAF

CVE-2026-18924 is fixed in 6 products on 1 platform, first by curl 8.18.0-1ubuntu2.7, released September 6, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-18924
- Priority: High
- CVSS: 9.1 (Moderate)
- EPSS: 0.0058
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-18924

## Description

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | curl Debian 14 | 8.22.0~rc2-1 | [DEBIAN-CVE-2026-18924](https://patchblox.com/security/data/fix/linux/debian-cve-2026-18924.md) | Sep 19, 2026 |
| Linux | curl Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | [curl 7.58.0-2ubuntu3.24+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-curl-7.58.0-2ubuntu3.24-esm14.md) | Sep 28, 2026 |
| Linux | curl Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | [curl 7.68.0-1ubuntu2.25+esm9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-curl-7.68.0-1ubuntu2.25-esm9.md) | Sep 28, 2026 |
| Linux | curl Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | [curl 7.81.0-1ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-curl-7.81.0-1ubuntu1.29.md) | Sep 28, 2026 |
| Linux | curl Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | [curl 8.5.0-2ubuntu10.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-curl-8.5.0-2ubuntu10.15.md) | Sep 28, 2026 |
| Linux | curl Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | [curl 8.18.0-1ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-curl-8.18.0-1ubuntu2.7.md) | Sep 6, 2026 |
| Linux | curl sles 15.6 | 8.22.0-150600.4.58.1 | [SUSE-SU-2026:5069-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5069-1.md) | Nov 7, 2026 |
| Linux | curl sles 15.7 | 8.22.0-150700.7.33.1 | [SUSE-SU-2026:5068-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5068-1.md) | Nov 7, 2026 |
| Linux | libcurl3-gnutls Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | [libcurl3-gnutls 7.58.0-2ubuntu3.24+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libcurl3-gnutls-7.58.0-2ubuntu3.24-esm14.md) | Sep 28, 2026 |
| Linux | libcurl3-gnutls Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | [libcurl3-gnutls 7.68.0-1ubuntu2.25+esm9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libcurl3-gnutls-7.68.0-1ubuntu2.25-esm9.md) | Sep 28, 2026 |
| Linux | libcurl3-gnutls Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | [libcurl3-gnutls 7.81.0-1ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcurl3-gnutls-7.81.0-1ubuntu1.29.md) | Sep 28, 2026 |
| Linux | libcurl3-nss Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | [libcurl3-nss 7.58.0-2ubuntu3.24+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libcurl3-nss-7.58.0-2ubuntu3.24-esm14.md) | Sep 28, 2026 |
| Linux | libcurl3-nss Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | [libcurl3-nss 7.68.0-1ubuntu2.25+esm9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libcurl3-nss-7.68.0-1ubuntu2.25-esm9.md) | Sep 28, 2026 |
| Linux | libcurl3-nss Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | [libcurl3-nss 7.81.0-1ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcurl3-nss-7.81.0-1ubuntu1.29.md) | Sep 28, 2026 |
| Linux | libcurl3t64-gnutls Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | [libcurl3t64-gnutls 8.5.0-2ubuntu10.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcurl3t64-gnutls-8.5.0-2ubuntu10.15.md) | Sep 28, 2026 |
| Linux | libcurl3t64-gnutls Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | [libcurl3t64-gnutls 8.18.0-1ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libcurl3t64-gnutls-8.18.0-1ubuntu2.7.md) | Sep 6, 2026 |
| Linux | libcurl4 Ubuntu 18.04.6 LTS (bionic) | 7.58.0-2ubuntu3.24+esm14 | [libcurl4 7.58.0-2ubuntu3.24+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libcurl4-7.58.0-2ubuntu3.24-esm14.md) | Sep 28, 2026 |
| Linux | libcurl4 Ubuntu 20.04 LTS (focal) | 7.68.0-1ubuntu2.25+esm9 | [libcurl4 7.68.0-1ubuntu2.25+esm9](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libcurl4-7.68.0-1ubuntu2.25-esm9.md) | Sep 28, 2026 |
| Linux | libcurl4 Ubuntu 22.04.1 LTS (jammy) | 7.81.0-1ubuntu1.29 | [libcurl4 7.81.0-1ubuntu1.29](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libcurl4-7.81.0-1ubuntu1.29.md) | Sep 28, 2026 |
| Linux | libcurl4t64 Ubuntu 24.04.5 LTS (noble) | 8.5.0-2ubuntu10.15 | [libcurl4t64 8.5.0-2ubuntu10.15](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libcurl4t64-8.5.0-2ubuntu10.15.md) | Sep 28, 2026 |
| Linux | libcurl4t64 Ubuntu 26.04.1 LTS (resolute) | 8.18.0-1ubuntu2.7 | [libcurl4t64 8.18.0-1ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libcurl4t64-8.18.0-1ubuntu2.7.md) | Sep 6, 2026 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo