diff --git a/meta/recipes-support/curl/curl/CVE-2026-18924.patch b/meta/recipes-support/curl/curl/CVE-2026-18924.patch
new file mode 100644
index 0000000000..cf8a3a6290
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-18924.patch
@@ -0,0 +1,56 @@
+From 90325ff0444cbdff368bda5d26d6405a0bb6ee43 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 5 Aug 2026 10:02:53 +0200
+Subject: [PATCH] http2: make server push transfers inherit share from
+ parent
+
+Reported-by: Stephan Zeisberg
+Closes #22488
+
+CVE: CVE-2026-18924
+Upstream-Status: Backport [https://github.com/curl/curl/commit/90325ff0444cbdff368bda5d26d6405a0bb6ee43]
+
+Backport Changes:
+- Use share.h because curl 8.7.1 does not have curl_share.h.
+- Use curl_easy_setopt(second, CURLOPT_SHARE, data->share)
+  instead of Curl_share_easy_link(), which is absent from curl 8.7.1.
+  The setter locks the share, updates its dirty counter and links
+  shared caches.
+- Retain curl_easy_duphandle() instead of the later curl_easy_init()
+  change in [1], preserving curl 8.7.1's documented push-option
+  inheritance. In 8.7.1, duplication leaves share and state.conn_cache
+  NULL. The share setter increments share->dirty before the push
+  callback and Curl_multi_add_perform(). Curl_close() drops the use
+  count on rejection or cleanup; curl_share_cleanup() refuses to free
+  a share still in use. The share lifetime fix therefore does not
+  require the later handle-creation change.
+
+[1] https://github.com/curl/curl/commit/fad90b666df98c93ee165341b0c8101c7b10ad7b
+
+(cherry picked from commit 90325ff0444cbdff368bda5d26d6405a0bb6ee43)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/http2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/http2.c b/lib/http2.c
+index 99d7f3b0e2..694900fd8c 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -47,6 +47,7 @@
+ #include "transfer.h"
+ #include "dynbuf.h"
+ #include "headers.h"
++#include "share.h"
+ /* The last 3 #include files should be in this order */
+ #include "curl_printf.h"
+ #include "curl_memory.h"
+@@ -776,6 +777,8 @@ static struct Curl_easy *h2_duphandle(struct Curl_cfilter *cf,
+       second->req.p.http = http;
+       http2_data_setup(cf, second, &second_stream);
+       second->state.priority.weight = data->state.priority.weight;
++      if(data->share)
++        (void)curl_easy_setopt(second, CURLOPT_SHARE, data->share);
+     }
+   }
+   return second;
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index b308aa1e3f..33265f0f25 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -43,6 +43,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-13608.patch \
            file://CVE-2026-8286.patch \
            file://CVE-2026-80230.patch \
+           file://CVE-2026-18924.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \