A flaw in the libcurl HTTP/2 Server Push handling can trigger a use‑after‑free during cleanup when connections are shared across handles. The freed memory can be accessed again, creating uncontrolled memory corruption that may cause application crashes. This weakness corresponds to CWE‑416.

The vulnerability affects the libcurl library used in curl. No specific version information is listed, so any installation that supports HTTP/2 Server Push and enables connection sharing between handles is potentially vulnerable.

The EPSS score is not available and the flaw has not been listed in CISA KEV, indicating there is no documented widespread exploitation yet. However, the use‑after‑free nature is a high‑severity issue that could be exploited by an attacker who can influence HTTP/2 push responses or control the shared connection context. The exploitability is inferred to be remote if the attacker controls the server or can induce the client to perform a server push, but the actual likelihood depends on environment specifics.