Change #278695
| Category | None |
| Changed by | Stefan Eissing <stefan@eissing.org> |
| Changed at | Tue 18 Aug 2026 08:22:26 |
| Repository | https://api.github.com/repos/curl/curl |
| Project | curl/curl |
| Branch | curl-8.20.X |
| Revision | 66324f6fe3d7013119925e3dea1e66aa7db73986 |
Comments
CVE-2026-10536: HTTP/2 stream-dependency tree UAF Cherry-picked from bfbff7852f050232edd3e5ca http2: remove stream dependency tracking The HTTP/2 feature is deprecated, few servers implement it and our implementation is complicated by its state management. Make the two CURLOPT_* involved a nop and deprecate them. Closes #21723
Changed files
- docs/libcurl/curl_easy_setopt.md
- docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
- docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
- docs/libcurl/symbols-in-versions
- include/curl/curl.h
- lib/http2.c
- lib/setopt.c
- lib/url.c
- lib/urldata.h