CVE-2026-18924

Executive Summary

CVE-2026-18924 is a use-after-free vulnerability (CWE-416) in libcurl's handling of HTTP/2 Server Push streams when the parent handle is configured to share connections with other handles. It carries a CVSS v3.1 base score of 9.1 (Critical), with the network attack vector and no privileges or user interaction required. Any application or service that uses libcurl with HTTP/2 Server Push and shared connection handles could be affected, with impact to integrity and availability — though confidentiality is scored as unaffected.

Technical Analysis

The vulnerability is a use-after-free in the cleanup path of libcurl's HTTP/2 Server Push stream handling. Per the NVD description, the flaw manifests specifically "when the parent handle is set to share connections with other handles." In libcurl, a "parent handle" refers to the main easy handle, and connection sharing is a documented feature where multiple easy handles can share a connection pool (enabled via share interfaces). When HTTP/2 Server Push is active and a pushed stream's lifecycle interacts with the shared connection cleanup, the free ordering is incorrect, leaving a dangling reference that is subsequently accessed during cleanup — the classic use-after-free pattern.

The attack surface is network-facing: HTTP/2 Server Push is a server-initiated feature, meaning a malicious or compromised HTTP/2 server can trigger the pushed-stream code path in a connecting client. The attacker does not need credentials or user interaction (PR:N, UI:N), and the vector is remote (AV:N). The CVSS subscores indicate high integrity and availability impact (I:H, A:H), while confidentiality is scored as none (C:N). The scope is unchanged (S:U), meaning the exploit is contained within the vulnerable component.

Key technical facts derivable from the provided data:

• Vulnerability class: use-after-free (CWE-416), a memory-safety defect.
• Trigger condition: HTTP/2 Server Push streams combined with shared connection handles on the parent handle.
• Failure point: the cleanup process.
• No specific function names, source file paths, or internal symbols are provided in the NVD description or CNA title, so those must not be speculated.

HTTP/2 Server Push is deprecated in many implementations and often disabled by default in modern libcurl builds, which limits the exposed population. However, where applications explicitly enable multipush/http2 push and use connection sharing, the bug is reachable. Because the flaw is in a widely embedded library (libcurl), the downstream blast radius spans countless applications, language bindings, and CLI tools.

Exploitation Scenarios

No public exploit code is reported in the provided intel (Exploit Code: NO), though POC_STATUS is marked "Public." The following attack chain is reasoned at the vulnerability-class level from the NVD description; no fabricated function names or endpoints are used.

1. Reconnaissance / target identification. An attacker identifies a client application or service that (a) uses libcurl, (b) has HTTP/2 enabled, (c) has HTTP/2 Server Push accepted, and (d) uses shared connection handles across multiple easy handles. This is typically inferred from the application's TLS/HTTP2 negotiation behavior. A malicious or attacker-controlled HTTP/2 origin server, a MITM position on the network path, or a compromised legitimate server can serve as the delivery vector.

2. Triggering the flaw. The attacker-controlled HTTP/2 server sends Server Push streams over the connection. When the client's parent handle shares that connection with other handles, the pushed-stream objects are cleaned up in an order that frees memory still referenced by the shared-connection cleanup path. This produces the use-after-free condition described in the NVD text. Successful triggering requires the push stream and the shared-connection cleanup to interleave as described.

3. Payload / execution method (vulnerability-class level). A use-after-free can be weaponized by heap grooming: the attacker controls the timing and content of HTTP/2 frames, potentially influencing heap layout. If the freed memory is reallocated with attacker-influenced data before the dangling pointer is dereferenced during cleanup, control-flow or data corruption can follow. Concrete exploitation depends on allocator behavior, memory protections (ASLR, heap hardening), and the specific libcurl build — no public PoC confirms a working exploit chain, so weaponization difficulty is considered moderate-to-high in practice.

4. Post-exploitation impact. Consistent with the CVSS subscores, the realistic outcomes are integrity and availability impact (I:H, A:H): memory corruption may cause crashes (availability) or manipulation of data/control within the process (integrity). Because confidentiality is scored as none, the primary modeled risk is process disruption or corruption rather than data exfiltration, though real-world memory-corruption exploitation can exceed the modeled scope.

Caveat: No public PoC code is available per the supplied data; the attack chain above is inferred from the vulnerability class (use-after-free) and the stated trigger conditions, not from confirmed exploit artifacts.

Impact Assessment

• CVSS 9.1 (Critical): AV:N (remote), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), S:U (unchanged scope), C:N, I:H, A:H. This places the vulnerability in the highest severity band while not requiring any preconditions an attacker cannot control (such as credentials or a local foothold).
• Affected systems: Any software embedding a vulnerable libcurl build that enables HTTP/2 Server Push and shares connections across handles. This spans server-side services, client applications, CLI tools, CI/CD pipelines, and language bindings (e.g., pycurl, curl-based SDKs) — though exact version ranges are not provided in the intel.
• Blast radius: libcurl is one of the most widely embedded networking libraries in existence, so even a narrow trigger condition creates a large potential downstream footprint. The practical constraint is the requirement for HTTP/2 Server Push, which is deprecated and frequently disabled, reducing real exposure.
• Business impact: Process crashes affecting availability of network-facing services (A:H), potential integrity compromise of in-process data (I:H), and downstream supply-chain concern for vendors that ship the library. No confidentiality impact is modeled. CISA KEV status is NO, indicating no confirmed exploitation in the wild at time of analysis.

Detection Guidance

Detection for a use-after-free in a client library is difficult to observe purely at the network layer because the triggering traffic is normal-looking HTTP/2 Server Push. The following rules are heuristic and should be tuned; none should be treated as high-fidelity.

Sigma Rule

title: Potential libcurl HTTP/2 Server Push Use-After-Free Trigger Attempt
id: 8c2f7a10-3b6d-4e9a-9c41-curl2026
status: experimental
description: Detects process crashes or anomalous HTTP/2 server push activity in applications using libcurl with shared connection handles (CVE-2026-18924). Heuristic only.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18924
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_lib:
    Image|endswith:
      - '\curl.exe'
  selection_push_flags:
    CommandLine|contains:
      - '--http2'
  condition: selection_lib and selection_push_flags
falsepositives:
  - Legitimate use of curl with HTTP/2 for non-malicious reasons
level: low
tags:
  - attack.t1190
  - cve.2026.18924

YARA Rule

rule CVE_2026_18924_libcurl_HTTP2_Push_UAF
{
    meta:
        description = "Heuristic detection of libcurl builds potentially affected by CVE-2026-18924 HTTP/2 Server Push use-after-free. String match is indicative only, not definitive."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18924"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lib = "libcurl" ascii wide nocase
        $h2  = "HTTP/2" ascii wide nocase
        $push = "Server Push" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $lib
        and ( $h2 or $push )
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-18924 libcurl HTTP/2 Server Push UAF trigger attempt"; flow:established,to_client; http2.header_name; content:"server"; nocase; http2.header_name; content:"push"; nocase; classtype:attempted-user; reference:nvd,2026-18924; metadata:cve CVE-2026-18924; sid:202618924; rev:1;)

Elastic Detection

process where process.name == "curl.exe" and
  process.command_line like~ "*--http2*" and
  (process.exit_code != 0 or process.thread.name == "curl")

Note: This is a low-confidence heuristic. For higher fidelity, correlate abnormal termination (crash) events from processes linked against libcurl with preceding outbound HTTP/2 sessions to Server Push-enabled servers.

Splunk SPL Query

index=main sourcetype=sysmon EventCode=1
| search Image="*curl*" CommandLine="*--http2*"
| eval risk="low_heuristic_CVE_2026_18924"
| table _time, host, User, Image, CommandLine, risk
| sort - _time

For crash correlation:

index=main (EventCode=1000 OR sourcetype=linux_audit)
| search (Message="*curl*" OR process="*curl*") AND (Message="*segfault*" OR Message="*access violation*")
| stats count by host, process, Message

Wazuh OSSEC Rule

<group name="curl,cve_2026_18924,">
  <rule id="100924" level="3">
    <decoded_as>json</decoded_as>
    <field name="process.name">curl.exe|curl</field>
    <field name="process.command_line">--http2</field>
    <description>CVE-2026-18924 heuristic: curl invoked with HTTP/2 (potential HTTP/2 Server Push UAF surface).</description>
    <options>no_full_log</options>
  </rule>

  <rule id="100925" level="10">
    <if_sid>100924</if_sid>
    <field name="event.type">crash</field>
    <description>CVE-2026-18924 possible exploitation: curl HTTP/2 process crash after server push activity.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The reference list cites NVD as the sole patch source; no vendor advisory version string or commit SHA is provided, so treat the fix as unverified until the upstream curl advisory and release notes confirm the resolved version.

1. Immediate mitigations

   • Disable HTTP/2 Server Push on client applications that use libcurl, if the application exposes a setting for it. Since the flaw is specific to the push-stream cleanup path, removing push eliminates the vulnerable code path. (Confirm the exact option name against your libcurl version's documentation — no option name is asserted here.)
   • Avoid sharing a single connection handle across multiple easy handles in configurations that also accept HTTP/2 Server Push, until a verified patch is applied.
   • Where feasible, force HTTP/1.1 or disable HTTP/2 for outbound client traffic as a temporary containment measure.
   • Monitor and refresh software bills of materials (SBOMs) to identify deployments embedding libcurl.

2. Patch / upgrade steps

   • Confirm the fixed libcurl version from the official curl security advisory page before rollout; the intel provided does not specify a version.
   • Replace bundled libcurl builds in container images, static binaries, and language bindings (the library may be compiled-in, not dynamically linked, so runtime patching alone is insufficient).
   • Rebuild and re-deploy dependent applications after the library upgrade, then verify HTTP/2 and push behavior in staging.

3. Long-term hardening

   • Standardize on a supported libcurl release line and subscribe to the curl security advisories mailing list.
   • Integrate OSV/NVD feeds into CI to catch embedded-library CVEs at build time.
   • Enable OS-level memory protections (ASLR, heap hardening, control-flow integrity) to raise exploitation cost for memory-safety defects.
   • Fuzz client HTTP/2 parsing paths and monitor for crashes in processes linking libcurl, using crash telemetry as an exploitation signal.

References

1. NVD — CVE-2026-18924: https://nvd.nist.gov/vuln/detail/CVE-2026-18924 (sole patch source; grant confidence 2/4)
2. MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
3. curl Project Security Advisory index (verify fixed version here before patching): https://curl.se/docs/security.html
4. FIRST EPSS — CVE-2026-18924 (score 0.00608, 47.2nd percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-18924
5. CISA KEV Catalog (status: NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation-in-the-wild: No CISA KEV listing, no confirmed exploit code, and no named threat actor campaigns are associated with CVE-2026-18924 in the provided intel. POC_STATUS is marked "Public" but Exploit Code is "NO"; treat any circulating claim of a working exploit as unverified until corroborated by a reputable source.