CVE-2026-10536: libcurl HTTP/2 stream-dependency tree use-after-free
CVE-2026-10536 is verified against curl/libcurl · github affected versions: 7.88.0 to 8.20.0 inclusive fixed version: curl 8.21.0 vulnerability class: Use-After-Free This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00278.
pruva-verify REPRO-2026-00278 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00278/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Use-after-free in libcurl HTTP/2 stream-dependency bookkeeping when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E on an easy handle, then calls curl_easy_reset() and later curl_easy_cleanup()
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.