Libcurl contains a flaw in its handling of HTTP/2 Server Push streams. When a parent handle is configured to share its connection pool with other handles, the cleanup of a Server Push stream can trigger a use‑after‑free. This results in memory corruption that may cause the client application to crash or exhibit unclear behavior. The weakness is a classic use‑after‑free (CWE‑416) and also involves a failure to perform necessary checks (CWE‑825). The impact is limited to memory corruption; there is no explicit mention of remote code execution or other advanced exploitation in the vendor description.

The issue affects any installation of libcurl that supports HTTP/2 Server Push and that has connection sharing enabled between handles. This includes the curl project and any software that bundles or links against libcurl. Because the affected code path involves shared connections, any application that reuses a curl handle for multiple requests while also allowing Server Push could potentially be impacted. Versions are not explicitly listed, so all libcurl builds with HTTP/2 support that permit connection sharing should be regarded as potentially vulnerable until a patched release is available.

The CVSS score of 9.1 marks this bug as high severity. The EPSS score of < 1 % indicates a low likelihood that the vulnerability is actively exploited today, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be remote if an attacker can control or craft an HTTP/2 Server Push response from a server to the vulnerable client. Exploitation would require the attacker to trigger the vulnerable cleanup by inducing the client to process a Server Push while connection sharing is enabled. Because the flaw is a memory corruption bug, the potential impact is primarily denial of service due to a crash, although in theory an attacker who gains control of the freed memory might achieve further compromise.