Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Rust 1.90.0-10 may free memory too early with shared HTTP/2 connections
published 1 month ago
Summary
The Rust package version 1.90.0-10 includes a library that can accidentally release memory while cleaning up shared HTTP/2 connections. This could cause the program to crash or behave unpredictably. Update to a newer version of the package or apply the provided fix to stop the premature memory release.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | rust | >= 1.85.0, <= 1.90.0-10 |
Original advisory text
CVE-2026-18924 affecting package rust 1.90.0-10
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent
handle is set to share connections with other handles, can lead to
use-after-free in the cleanup process.
handle is set to share connections with other handles, can lead to
use-after-free in the cleanup process.
References
Timeline
Published6 Sep 2026
Updated8 Sep 2026
First seen8 Sep 2026
Sources
AZL-99858 · OSV
Track software like this
Free during beta