Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-18924, describes a use-after-free (UAF) in libcurl's handling of HTTP/2 Server Push streams when the parent handle shares connections. The provided fix commit 90325ff0444cbdff368bda5d26d6 directly addresses this issue by modifying the h2_duphandle function in lib/http2.c. This function is responsible for creating a new easy handle for a server-pushed stream. The patch introduces a call to Curl_share_easy_link(second, data->share) within an if(data->share) block. This indicates that in the vulnerable version, the second easy handle (for the pushed stream) was not being correctly linked to the shared connection data (data->share). Without this explicit linking, the cleanup process for the pushed stream's handle could lead to a UAF, as it might attempt to access or free resources that were already managed or freed by the parent handle's shared connection cleanup. The addition of #include "curl_share.h" also points to the fact that the sharing mechanism was not fully considered in this file's context for this specific function. Therefore, h2_duphandle is the function where the critical omission occurred, making it the vulnerable function.
h2_duphandlelib/http2.c