A critical use-after-free vulnerability in the libcurl library allows unauthenticated attackers to potentially trigger memory corruption or service disruption.

This is a use-after-free vulnerability (CWE-416) occurring within the libcurl cleanup process for HTTP/2 Server Push streams. The flaw is reachable by unauthenticated remote attackers when a parent handle is configured to share connections with other handles.

The vulnerability carries a CVSS score of 9.1, reflecting its critical nature and the potential for significant impact on system integrity and availability. Successful exploitation could lead to application crashes, denial of service, or potentially arbitrary code execution depending on the specific memory management state of the host environment. This poses a severe risk to any infrastructure relying on libcurl for network communications.

Immediate Action: Organizations should audit their environments to identify instances of the affected libcurl versions and prepare to update to the next secure release once available from the vendor.

Proactive Monitoring: Security teams should monitor system and application logs for unusual crashes or termination signals originating from processes utilizing libcurl, which may indicate attempted exploitation.

Compensating Controls: Given the network-based nature of this flaw, deploying or updating rules on a Web Application Firewall or network intrusion detection system to inspect and block malformed HTTP/2 traffic may provide temporary protection.

Public Exploit Available: Unknown.

Due to the critical severity of this vulnerability and the potential for memory corruption, immediate attention is required. Administrators should prioritize identifying all systems utilizing the affected versions of libcurl and track the upstream repository for the official patch release. Once the patch is available, it must be deployed across all environments as a matter of urgency to eliminate the risk of exploitation.