Skip to main content

libcurl CVE-2026-9080

| EUVDEUVD-2026-41511 HIGH
Use After Free (CWE-416)
2026-06-24 GHSA-hf34-v47h-w6m3
Information Disclosure Use After Free Memory Corruption Curl Haxx
7.3
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach libcurl app using event-based multi interface
  2. Delivery
    Server drives socket activity into CURLMOPT_SOCKETFUNCTION callback
  3. Exploit
    Application calls curl_easy_pause() during callback
  4. Execution
    libcurl writes flag via freed struct pointer
  5. Impact
    Use-after-free corrupts heap or leaks memory

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the host application (1) uses libcurl's multi interface in event-based mode with a registered CURLMOPT_SOCKETFUNCTION socket callback, and (2) calls curl_easy_pause() from inside that callback - this exact pattern is the triggering condition, per the description. Applications using the easy interface, or the multi interface without event-based socket callbacks, or that never pause from within the callback, are not affected. This is a strong limiting factor: despite the CVSS PR:N/UI:N/AC:L metrics implying trivial remote reach, the defect only surfaces in the specific subset of libcurl-consuming applications written this way, so realistic risk is bounded by that deployment/coding pattern rather than by mere network exposure.
Impact

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3) rates this network-reachable, low-complexity, unauthenticated with low impact across CIA, but that scoring is in tension with the description: exploitation is not a straightforward remote request against a listening service - it only manifests when the host application itself uses the curl_easy_pause()-inside-socket-callback pattern, which is an application coding condition, not an attacker-supplied one. This gap should be verified against the curl advisory; in practice the real-world attack complexity is higher than AC:L implies. Corroborating signals point to modest real risk: EPSS is 0.21% (11th percentile), the CVE is not in CISA KEV, and no public exploit is identified. The low EPSS and absence of KEV, combined with the narrow trigger, suggest this is a genuine memory-safety defect worth patching but not an urgent widely-exploitable threat. Note that a HackerOne report (3749204) is referenced as the disclosure channel; that indicates responsible disclosure, not public weaponized exploit code.
Exploit ScenarioDerived

An application uses libcurl's event-based multi interface and, inside its CURLMOPT_SOCKETFUNCTION callback, calls curl_easy_pause() in response to socket activity driven by a remote server. A malicious or misbehaving server times its responses so the callback fires and pauses at the moment the transfer struct is freed, causing libcurl to write through the dangling pointer and corrupt heap memory or leak adjacent data. No public exploit code is available, and because AC is effectively high (the vulnerable code path depends on the application's specific API usage), reliable exploitation would require precise conditions.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jul 06, 2026

Use-after-free in libcurl 8.13.0 through 8.20.0 occurs when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a flag through a struct pointer whose backing memory was just freed. Affected are applications built on the curl multi interface using event-based socket callbacks; the flaw can lead to memory corruption or limited information disclosure (tagged Information Disclosure) with low confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), consistent with a niche triggering pattern rather than mass exploitation.

Earlier versions of this analysis (4)
v4 Jul 06, 2026 - 18:45 cvss changed CVSS 7.3

Use-after-free in libcurl (curl 8.13.0 through 8.20.0) is triggered when an application calls curl_easy_pause() from inside its event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a pause flag through an already-freed struct pointer. It is exploitable only in applications that use the multi/event interface in this specific way, with limited confidentiality, integrity and availability impact; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). A vendor patch is available and Ubuntu has shipped a fix (USN-8487-1).

v3 Jul 06, 2026 - 18:44 cvss changed CVSS 7.3

Use-after-free in libcurl (curl 8.13.0 through 8.20.0) is triggered when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback; libcurl then writes a pause flag through a struct pointer whose memory was already freed. The flaw is a classic CWE-416 memory-safety issue that can lead to information disclosure, memory corruption, or a crash of the host process. No public exploit identified at time of analysis, and the EPSS probability is low (0.21%, 11th percentile), consistent with a bug reachable only through a specific programming pattern rather than a broadly weaponizable network vector.

v2 Jul 06, 2026 - 18:43 cvss changed CVSS 7.3

Use-after-free in libcurl (curl 8.13.0 through 8.20.0) occurs when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a flag through a struct pointer whose memory was just freed. The flaw is application-usage-dependent rather than a directly network-triggered bug, and per its Information Disclosure tagging can leak small amounts of memory or corrupt state. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating limited near-term exploitation likelihood.

v1 Jun 24, 2026 - 18:25

Use-after-free in libcurl's socket callback handler allows memory corruption when a transfer is paused and the socket callback is subsequently invoked against freed memory. All applications embedding libcurl versions prior to 8.21.0 that use the socket callback API alongside transfer pause functionality are affected. No public exploit is identified at time of analysis and no KEV listing exists, consistent with the LOW severity designation from the curl project.

RemediationAI

Patch available per vendor advisory: upgrade libcurl to the fixed release referenced in the curl security advisory at https://curl.se/docs/CVE-2026-9080.html (the input does not state an exact fixed version, so confirm the patched tag directly from that advisory rather than assuming one). Distribution users should apply their vendor package updates, for example via Ubuntu USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1). If patching cannot be done immediately, the specific compensating control is at the application layer: avoid calling curl_easy_pause() from within the CURLMOPT_SOCKETFUNCTION callback - defer the pause to outside the callback (e.g., set a flag and call curl_easy_pause() after the event loop returns from the callback), which removes the re-entrancy that frees and then reuses the struct; the trade-off is a minor refactor of the event-loop integration code and slightly deferred pause timing. Applications that do not use event-based socket callbacks or do not pause from within them are not exposed and need only the routine library update.

Affected VersionsENISA

curl 8.20.0 ≤8.20.0
curl 8.13.0 ≤8.13.0
curl 8.16.0 ≤8.16.0
curl 8.14.0 ≤8.14.0
curl 8.14.1 ≤8.14.1
curl 8.19.0 ≤8.19.0
curl 8.15.0 ≤8.15.0
curl 8.17.0 ≤8.17.0
curl 8.18.0 ≤8.18.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The issue lives in libcurl, the client-side URL transfer library embedded in countless applications, and specifically in its 'multi' interface event-driven mode. When an application registers a CURLMOPT_SOCKETFUNCTION callback (the model used with epoll/kqueue/libevent-style event loops), libcurl invokes that callback to inform the app about socket activity. Calling curl_easy_pause() from within that callback re-enters libcurl at a point where the relevant easy-handle/transfer struct has already been freed; libcurl then dereferences the dangling pointer to store a pause flag, which is a classic use-after-free. Although the input lists CWE as N/A, the described behavior is CWE-416 (Use After Free): a freed object is accessed because a reference to it outlives its lifetime, and the write-after-free can corrupt heap state or expose adjacent memory.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI 5.6 MEDIUM

AC:H because the flaw only triggers in apps that call curl_easy_pause() inside the socket callback with race-like timing; UAF yields limited C/I/A impact, no auth needed so PR:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.3 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

5
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v5 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v4 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:44 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 06, 2026 - 18:43 vuln.today
v2 - CVSS changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
7.3 (HIGH)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in OpenSSL - CVE-2026-9080 Jun 24, 2026

Executive ViewAI

Why It Matters

libcurl versions 8.13.0 through 8.20.0 contain a use-after-free vulnerability in event-based callback handling that could cause memory corruption or data leaks in affected applications. Given libcurl's prevalence in production systems including web servers and microservices, prompt patching is essential to prevent potential system compromise; exploitation requires specific code patterns and no public exploit has been identified at time of analysis, but the vulnerability's severity justifies immediate action.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Ubiquitous
libcurl is embedded in a vast fraction of software and systems
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9080 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376076 REF https://curl.se/docs/CVE-2026-9080.json REF https://hackerone.com/reports/3749204

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy