THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-10536 (CRITICAL 9.8) — A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. Dur

[NVD] CVE-2026-10536 (CRITICAL 9.8) — A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. Dur

lownvdPublished 2026-07-03

CVE-2026-10536 CVSS: 9.8 CRITICAL Published: 2026-07-03T07:16:23.563

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to

Indicators of compromise

CVE-2026-10536cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10536