Skip to main content

libcurl CVE-2026-80229

| EUVDEUVD-2026-72167 HIGH
Use After Free (CWE-416)
2026-09-02 GHSA-jrp3-jq4v-w9gc
Use After Free Memory Corruption OpenSSL Curl Haxx
7.5
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Control TLS server endpoint
  2. Delivery
    Sustain pooled TLS connection to victim
  3. Exploit
    Trigger early easy handle destruction in client
  4. Execution
    Subsequent I/O dereferences freed OSSL_LIB_CTX
  5. Impact
    Heap-use-after-free crashes client process

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Three concurrent conditions are required: (1) the application must use libcurl's multi interface (not the simple easy interface) with connection pool reuse enabled - this is the default for multi-handle users; (2) libcurl must be built against OpenSSL 3 with provider-based library context configurations; (3) an easy handle must be destroyed or cleaned up while an associated TLS connection remains active in the multi handle's connection cache, creating the lifetime mismatch. Exploitation is limited by the need to trigger the specific handle destruction timing and requires a network peer (attacker-controlled or compromised TLS server) to sustain the pooled connection during the vulnerable window. Curl builds against non-OpenSSL-3 TLS backends are not affected.
Impact

The vendor-supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5), reflecting a remotely triggerable crash with no confidentiality or integrity impact. However, AC:L appears optimistic: exploitation requires the target application to be compiled against OpenSSL 3 with provider configurations, to use libcurl's multi interface with connection pooling, and for an easy handle to be destroyed while a pooled TLS connection to an attacker-controlled server remains active - a conjunction of conditions that narrows the realistic exposure. An independent assessment of AC:H is more appropriate. EPSS at 0.22% (12th percentile) confirms low near-term exploitation probability, consistent with the absence from CISA KEV. The primary near-term risk is denial-of-service for long-running transfer-heavy applications (e.g., download managers, CI/CD agents, web crawlers). While UAF bugs carry inherent potential for code execution beyond DoS, the vendor assessment of C:N/I:N is noted and there is no evidence of a working exploit beyond memory corruption.
Exploit ScenarioDerived

An attacker operates a TLS server that keeps connections alive with session tickets or post-handshake authentication. A client application using libcurl's multi interface against OpenSSL 3 initiates a transfer, the easy handle is prematurely freed (e.g., via a timeout or application logic race), and the pooled connection attempts a subsequent read or renegotiation - dereferencing the freed OSSL_LIB_CTX and crashing the client process. No public proof-of-concept has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 08, 2026

Heap-use-after-free in libcurl versions 8.14.0 through 8.21.0 allows remote unauthenticated attackers to crash applications performing concurrent TLS transfers via the multi interface. When libcurl builds against OpenSSL 3 with provider configurations, an allocated OpenSSL library context is tied to an easy handle's lifetime without an ownership reference being passed to OpenSSL; if the easy handle is destroyed while a pooled TLS connection remains active, subsequent I/O or post-handshake operations dereference the freed context, triggering a heap-use-after-free. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.22% (12th percentile).

Earlier versions of this analysis (1)
v1 Sep 02, 2026 - 12:17

Use-after-free in curl's OpenSSL provider component, fixed in curl 8.22.0 released September 2, 2026. The flaw occurs within curl's integration layer for the OpenSSL TLS backend, where a freed memory region can be accessed during SSL/TLS connection handling. Affected deployments include any application or system using libcurl built against OpenSSL as the TLS provider; no public exploit or active exploitation has been identified at time of analysis.

RemediationAI

Upgrade to a patched version of curl; the exact fixed release is not independently confirmed from the input data, but https://curl.se/docs/CVE-2026-80229.html and https://curl.se/docs/vuln-8.21.0.html should be consulted for the vendor-confirmed fix version. Until patching is possible, operators can reduce exposure by configuring libcurl to disable connection pooling (CURLMOPT_MAXCONNECTS=0 or per-transfer CURLOPT_FORBID_REUSE=1), which prevents easy handles from being recycled into the shared pool and eliminates the lifetime mismatch; the trade-off is increased TLS handshake overhead and reduced throughput. Where OpenSSL 3 provider configurations are not required, falling back to a non-provider OpenSSL 3 build or an alternative TLS backend avoids the vulnerable code path. Applications should also ensure easy handles are not destroyed while associated multi-handle transfers remain in progress.

Affected VersionsENISA

curl 8.19.0 ≤8.19.0
curl 8.21.0 ≤8.21.0
curl 8.14.1 ≤8.14.1
curl 8.18.0 ≤8.18.0
curl 8.17.0 ≤8.17.0
curl 8.15.0 ≤8.15.0
curl 8.20.0 ≤8.20.0
curl 8.16.0 ≤8.16.0
curl 8.14.0 ≤8.14.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcurl's multi interface enables asynchronous, concurrent transfers using a pool of reusable connections and easy handles. When compiled against OpenSSL 3, libcurl may instantiate a custom OSSL_LIB_CTX (provider library context) and attach it to an easy handle's SSL state. The root cause (CWE-416: Use After Free) is that this context is passed to OpenSSL without incrementing a reference count or transferring ownership: the easy handle acts as the sole owner, so calling curl_easy_cleanup() frees the context even while a pooled TLS connection - kept alive in the multi handle's connection cache - still holds a raw pointer to it. Any subsequent operation on that connection (reads, writes, SSL renegotiation, or session resumption) dereferences the stale pointer. Affected versions span curl 8.14.0 through 8.21.0 as listed in EUVD-2026-72167.

Know when OpenSSL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

AC:H reflects the conjunction of OpenSSL 3 provider config, multi interface, and specific easy-handle lifecycle timing required for exploitation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Updated
Sep 08, 2026 - 16:37 vuln.today
v2 - CVSS changed
CVSS changed
Sep 08, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in curl OpenSSL TLS Backend - CVE-2026-80229 Sep 02, 2026

Executive ViewAI

Why It Matters

libcurl versions 8.14.0 through 8.21.0 contain a memory-management vulnerability allowing remote, unauthenticated attackers to crash applications performing concurrent TLS transfers. This affects a broad installed base across enterprise software, creating denial-of-service risk for any service relying on vulnerable libcurl versions for HTTPS communication.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict or throttle concurrent TLS connection pooling through application configuration of libcurl's multi interface; (2) implement network-level connection rate limiting and request throttling to reduce sustained concurrent transfer scenarios; (3) deploy application monitoring and alerting for unexpected crashes or high restart rates as exploitation indicators; (4) network segmentation to limit untrusted sources' ability to initiate TLS connections against affected services. These controls reduce attack surface but do not remediate the vulnerability-prioritize vendor patch deployment immediately upon release.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Ubiquitous
libcurl underlies HTTP clients across virtually all platforms and languages
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2021-3711 CRITICAL POC
9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH
7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/rust:1.97 Container bci/rust:latest Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.99 Container private-registry/harbor-trivy-adapter:1.1.3-2.117 Container suse/kea:2.6-79.22 Container suse/kiosk/firefox-esr:140.14-75.25 Container suse/postgres:16 Container suse/postgres:16.15 Container suse/postgres:17 Container suse/postgres:17.11 Container suse/postgres:latest Container suse/rmt-server:latest Affected
Container bci/golang:1.25.14-3.72.4 Container bci/golang:1.25.14-openssl-90.8 Container bci/golang:1.26.7-2.73.4 Container bci/golang:1.26.7-openssl-90.8 Container bci/node:22 Container bci/openjdk:17 Container bci/openjdk:21 Container bci/openjdk:latest Container bci/python:3 Container bci/python:latest Container bci/ruby:2 Container bci/ruby:latest Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.154 Container suse/sle15:latest Affected
Container suse/ltss/sle15.6/sle15:15.6-5.89 Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

References

Advisories & patches
ADVISORY https://curl.se/docs/CVE-2026-80256.html ADVISORY https://curl.se/docs/vuln-8.21.0.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80229 ADVISORY https://rock-solid.curl.dev ADVISORY https://seclists.org/oss-sec/2026/q3/637 ADVISORY https://ubuntu.com/security/notices/USN-8820-1 ADVISORY https://vuldb.com/vuln/399468 REF https://curl.se/docs/CVE-2026-80229.html REF https://curl.se/docs/CVE-2026-80229.json REF https://hackerone.com/reports/3969255

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy