| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.88.0, < 8.21.0 | 8.21.0 |
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free