CVE-2026-10536

CriticalCVSS 9.8/10Last modified Sep 15, 2026

Description

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-105375.3A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users CVE-2026-105388.0Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in th CVE-2026-1053827.3A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function CVE-2026-1053837.3A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an u CVE-2026-1053847.3A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function CVE-2026-1053857.3A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this CVE-2026-1053867.3A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this CVE-2026-1053877.3A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This af CVE-2026-1053886.3A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index CVE-2026-1053896.3A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feel CVE-2026-105399.0A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue CVE-2026-1053906.9Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers