From 9b36748938a1827d2d7658de531751a31bd6b608 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 30 Mar 2026 08:49:31 +0200
Subject: [PATCH] http2: return error on OOM in push headers

Reported-by: M42kL33 on hackerone
Bug: https://hackerone.com/reports/3636044
Closes #21171
---
 lib/http2.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/http2.c b/lib/http2.c
index 8a472da4b2..0757ab36de 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1488,8 +1488,11 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
       stream->push_headers = headp;
     }
     h = curl_maprintf("%s:%s", name, value);
-    if(h)
-      stream->push_headers[stream->push_headers_used++] = h;
+    if(!h) {
+      free_push_headers(stream);
+      return NGHTTP2_ERR_CALLBACK_FAILURE;
+    }
+    stream->push_headers[stream->push_headers_used++] = h;
     return 0;
   }