It was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution. https://security-tracker.debian.org/tracker/DSA-6558-1