CVE-2026-10536 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-10536 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-10536 is a use-after-free vulnerability in Haxx libcurl affecting the HTTP/2 stream-dependency tree management interface, specifically triggered through the CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E configuration options.

Technical Detail

The flaw arises when an application configures an HTTP/2 stream-dependency tree using CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E and subsequently performs operations that result in the underlying stream object being freed while a reference to it remains accessible. An attacker who can influence the sequence of curl handle operations, or who controls a server-side response that drives stream lifecycle events, may be able to trigger the use-after-free condition. Successful exploitation could lead to arbitrary code execution within the context of the application using libcurl, or at minimum, a denial of service through process crash.

Exploitation Status

No known exploit exists for this vulnerability at this time. It has not been added to the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept or weaponized code has been observed or confirmed as of July 10, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE in available intelligence sources.

What To Do

Organizations should prioritize patching libcurl to the latest available version that addresses this vulnerability, given the critical CVSS score of 9.8 and the widespread use of libcurl across applications, embedded systems, and development toolchains. Identify all internal applications and dependencies that invoke CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E and treat those as highest priority for remediation. As a short-term workaround, applications that do not require HTTP/2 stream prioritization should disable use of these options entirely. Monitor process crash telemetry and memory corruption signals in applications that use libcurl with HTTP/2 enabled. This CVE is not currently KEV-listed, so no CISA binding directive deadline applies, but the critical severity warrants treating it as a priority patch cycle item.