An HTTP/2 RESET_STREAM message received from a server during an upload can trigger curl to free an internal connection structure before all references to it are released. This use‑after‑free can corrupt memory and may lead to undefined behavior. The weakness is formally identified as a use‑after‑free flaw.

The vulnerability impacts the curl client library. No specific product versions are listed in the advisory, so all installations using curl for HTTP/2 uploads could be vulnerable until a patched release is deployed.

The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The CVSS score is 8.1, indicating a high severity. Because an attacker who controls the HTTP server can send a RST_STREAM with the reason HTTP_1_1_REQUIRED or REFUSED_STREAM, the likely attack vector is remote. The use‑after‑free can corrupt memory and may lead to undefined behavior, but the low exploitation probability and lack of current evidence reduce the immediate threat level.