Out-of-bounds read In curl
Description
A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or
CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and
finally terminates the handle with curl_easy_cleanup(). During this final
cleanup phase, libcurl attempts to access and modify an internal structure
that was already freed during the reset operation.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.23 | >=7.88.0 <8.22.0-r0 | 8.22.0-r0 | |
 debian 13 | =8.14.1-2 || =8.14.1-2+deb13u1 || =8.14.1-2+deb13u2 || =8.14.1-2+deb13u2~bpo13+1 || =8.14.1-2+deb13u3 || =8.14.1-2+deb13u4 || =8.14.1-2+deb13u5 || =8.14.1-2+exp1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0-1 || =8.21.0-1+exp1 || =8.21.0-2 || =8.21.0-2+exp1 || =8.21.0-2~bpo13+1 || =8.21.0~rc1-1+exp1 || =8.21.0~rc2-1 || =8.21.0~rc2-1+exp1 || =8.21.0~rc3-1 || =8.21.0~rc3-1+exp1 || =8.22.0-1 || =8.22.0-1+exp1 || =8.22.0~rc2-1 || =8.22.0~rc2-2 || =8.22.0~rc3-1 || =8.22.0~rc3-1+exp1 || =8.23.0~rc1-1 || =8.23.0~rc1-2 || =8.23.0~rc2-1 || =8.23.0~rc2-1+exp1 | - | |
debian 14 | =8.14.1-2 || =8.14.1-2+exp1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0~rc1-1+exp1 || >=0 <8.21.0~rc2-1 | 8.21.0~rc2-1 | |
debian 12 | =7.88.1-10 || =7.88.1-10+deb12u1 || =7.88.1-10+deb12u11 || =7.88.1-10+deb12u12 || =7.88.1-10+deb12u13 || =7.88.1-10+deb12u14 || =7.88.1-10+deb12u15 || =7.88.1-10+deb12u1~bpo11+1 || =7.88.1-10+deb12u2 || =7.88.1-10+deb12u3 || =7.88.1-10+deb12u3~bpo11+1 || =7.88.1-10+deb12u4 || =7.88.1-10+deb12u5 || =7.88.1-10+deb12u5~bpo11+1 || =7.88.1-10+deb12u6 || =7.88.1-10+deb12u6~bpo11+1 || =7.88.1-10+deb12u7 || =7.88.1-10+deb12u8 || =7.88.1-10+deb12u9 || =7.88.1-11 || =8.0.1-1~exp1 || =8.10.0-1 || =8.10.0-2 || =8.10.1-1 || =8.10.1-1~bpo12+1 || =8.10.1-2 || =8.11.0-1 || =8.11.1-1 || =8.11.1-1~bpo12+1 || =8.12.0+git20250209.89ed161+ds-1 || =8.12.0+git20250209.89ed161+ds-1~bpo12+1 || =8.12.1-1 || =8.12.1-2 || =8.12.1-2~bpo12+1 || =8.12.1-3 || =8.12.1-3~bpo12+1 || =8.13.0-1 || =8.13.0-1+exp1 || =8.13.0-2 || =8.13.0-2+exp1 || =8.13.0-3 || =8.13.0-4 || =8.13.0-4+exp1 || =8.13.0-5 || =8.13.0-5+exp1 || =8.13.0-5~bpo12+1 || =8.13.0~rc-1~exp1 || =8.13.0~rc-1~exp2 || =8.13.0~rc2-1 || =8.13.0~rc2-2 || =8.13.0~rc3-1 || =8.13.0~rc3-1+exp1 || =8.14.0-1 || =8.14.0-1+exp1 || =8.14.0~rc1-1+exp1 || =8.14.0~rc2-1+exp1 || =8.14.0~rc3-1+exp1 || =8.14.1-1 || =8.14.1-1~bpo12+1 || =8.14.1-2 || =8.14.1-2+exp1 || =8.14.1-2~bpo12+1 || =8.15.0-1 || =8.15.0-1~bpo13+1 || =8.15.0-1~exp1 || =8.15.0~rc1-1exp1 || =8.15.0~rc2-1~exp1 || =8.15.0~rc3-1~exp1 || =8.16.0-1 || =8.16.0-1+exp1 || =8.16.0-1~bpo13+1 || =8.16.0-2 || =8.16.0-3 || =8.16.0-4 || =8.16.0-4~bpo13+1 || =8.16.0~rc1-1~exp1 || =8.16.0~rc2-1 || =8.16.0~rc2-2 || =8.16.0~rc3-1 || =8.17.0-1 || =8.17.0-2 || =8.17.0-3 || =8.17.0~rc1-1~exp1 || =8.17.0~rc2-1 || =8.17.0~rc3-1 || =8.18.0-1 || =8.18.0-1~bpo13+1 || =8.18.0-2 || =8.18.0~rc1-1+exp1 || =8.18.0~rc2-1 || =8.18.0~rc3-1 || =8.19.0-1 || =8.19.0-1+exp1 || =8.19.0-1~bpo13+1 || =8.19.0-2 || =8.19.0-3 || =8.19.0-3+exp1 || =8.19.0-3+exp2 || =8.19.0~rc1-1~exp1 || =8.19.0~rc2-1 || =8.19.0~rc2-2 || =8.19.0~rc3-1 || =8.2.1-1 || =8.2.1-2 || =8.2.1-2~bpo12+1 || =8.20.0-1 || =8.20.0-1+exp || =8.20.0-2 || =8.20.0-2+exp1 || =8.20.0-2~bpo13+1 || =8.20.0-3 || =8.20.0-4 || =8.20.0-5 || =8.20.0-5~bpo13+1 || =8.20.0~rc1-1+exp1 || =8.20.0~rc1-1+exp2 || =8.20.0~rc1-1+exp3 || =8.20.0~rc2-1 || =8.20.0~rc2-1+exp1 || =8.20.0~rc3-1 || =8.20.0~rc3-1+exp1 || =8.21.0-1 || =8.21.0-1+exp1 || =8.21.0-2 || =8.21.0-2+exp1 || =8.21.0-2~bpo13+1 || =8.21.0~rc1-1+exp1 || =8.21.0~rc2-1 || =8.21.0~rc2-1+exp1 || =8.21.0~rc3-1 || =8.21.0~rc3-1+exp1 || =8.22.0-1 || =8.22.0-1+exp1 || =8.22.0~rc2-1 || =8.22.0~rc2-2 || =8.22.0~rc3-1 || =8.22.0~rc3-1+exp1 || =8.23.0~rc1-1 || =8.23.0~rc1-2 || =8.23.0~rc2-1 || =8.23.0~rc2-1+exp1 || =8.3.0-1 || =8.3.0-2 || =8.3.0-2~bpo12+1 || =8.3.0-2~exp1 || =8.3.0-3 || =8.4.0-1 || =8.4.0-2 || =8.4.0-2~bpo12+1 || =8.5.0-1 || =8.5.0-1+exp1 || =8.5.0-2 || =8.5.0-2+exp1 || =8.5.0-2~bpo12+1 || =8.6.0-1 || =8.6.0-1.1 || =8.6.0-2 || =8.6.0-3 || =8.6.0-3.1 || =8.6.0-3.1~exp1 || =8.6.0-3.1~exp2 || =8.6.0-3.2 || =8.6.0-4 || =8.7.1-1 || =8.7.1-1+exp1 || =8.7.1-2 || =8.7.1-3 || =8.7.1-4 || =8.7.1-5 || =8.7.1-5+exp1 || =8.7.1-5~bpo12+1 || =8.8.0-1 || =8.8.0-1+exp1 || =8.8.0-1+exp2 || =8.8.0-1~bpo12+1 || =8.8.0-2 || =8.8.0-3 || =8.8.0-4 || =8.9.0-1 || =8.9.0-2 || =8.9.0-3 || =8.9.1-1 || =8.9.1-2 || =8.9.1-2~bpo12+1 | - | |
alpine v3.24 | >=7.88.0 <8.21.0-r0 | 8.21.0-r0 | |
 rpm rhel10 | - | - | |
rpm rhel10 | - | - | |
rpm rhel10 | - | - |
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.