CVE-2026-10536
ADVISORY - nistSummary
A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or
CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and
finally terminates the handle with curl_easy_cleanup(). During this final
cleanup phase, libcurl attempts to access and modify an internal structure
that was already freed during the reset operation.
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-10536
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.23 | <=8.19.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.24 | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.23 | <=8.17.0-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.20.0-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <8.21.0-r0 | 8.21.0-r0 |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-10536
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
9.8criticalDebian
CREATED
UPDATED
ADVISORY IDCVE-2026-10536
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowUbuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-10536
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowChainguard
CREATED
UPDATED
ADVISORY ID
CGA-fff6-98xx-2cx6
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-10536
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
9.8criticalminimos
CREATED
UPDATED
ADVISORY ID
MINI-vgm9-vx39-f32r
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-x888-fhwf-c2pr
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-