From 44a79d4f7afe52ca613516cf9dd5d83ac7d5c2c0 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Wed, 8 Oct 2025 12:28:14 +0200
Subject: [PATCH] http2: cleanup pushed newhandle on fail

When nghttp2_session_set_stream_user_data() fails, clean up the
new handle.

Reported-by: Joshua Rogers
Closes #18931
---
 lib/http2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/http2.c b/lib/http2.c
index ff53fc4b94..43f4e9106c 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1030,6 +1030,7 @@ static int push_promise(struct Curl_cfilter *cf,
       infof(data, "failed to set user_data for stream %u",
             newstream->id);
       DEBUGASSERT(0);
+      discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }
-- 
2.47.3