Skip to main content

libcurl CVE-2026-9080

| EUVDEUVD-2026-41511 HIGH
Use After Free (CWE-416)
2026-06-24 GHSA-hf34-v47h-w6m3
Information Disclosure Use After Free Memory Corruption Curl Red Hat
7.3
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
5.6 MEDIUM

AC:H because the flaw only triggers in apps that call curl_easy_pause() inside the socket callback with race-like timing; UAF yields limited C/I/A impact, no auth needed so PR:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

7
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v5 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:45 vuln.today
v4 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:44 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:43 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 06, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
7.3 (HIGH)
Analysis Generated
Jun 24, 2026 - 18:25 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in OpenSSL - CVE-2026-9080 Jun 24, 2026

AnalysisAI

Use-after-free in libcurl 8.13.0 through 8.20.0 occurs when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a flag through a struct pointer whose backing memory was just freed. Affected are applications built on the curl multi interface using event-based socket callbacks; the flaw can lead to memory corruption or limited information disclosure (tagged Information Disclosure) with low confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), consistent with a niche triggering pattern rather than mass exploitation.

Technical ContextAI

The issue lives in libcurl, the client-side URL transfer library embedded in countless applications, and specifically in its 'multi' interface event-driven mode. When an application registers a CURLMOPT_SOCKETFUNCTION callback (the model used with epoll/kqueue/libevent-style event loops), libcurl invokes that callback to inform the app about socket activity. Calling curl_easy_pause() from within that callback re-enters libcurl at a point where the relevant easy-handle/transfer struct has already been freed; libcurl then dereferences the dangling pointer to store a pause flag, which is a classic use-after-free. Although the input lists CWE as N/A, the described behavior is CWE-416 (Use After Free): a freed object is accessed because a reference to it outlives its lifetime, and the write-after-free can corrupt heap state or expose adjacent memory.

RemediationAI

Patch available per vendor advisory: upgrade libcurl to the fixed release referenced in the curl security advisory at https://curl.se/docs/CVE-2026-9080.html (the input does not state an exact fixed version, so confirm the patched tag directly from that advisory rather than assuming one). Distribution users should apply their vendor package updates, for example via Ubuntu USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1). If patching cannot be done immediately, the specific compensating control is at the application layer: avoid calling curl_easy_pause() from within the CURLMOPT_SOCKETFUNCTION callback - defer the pause to outside the callback (e.g., set a flag and call curl_easy_pause() after the event loop returns from the callback), which removes the re-entrancy that frees and then reuses the struct; the trade-off is a minor refactor of the event-loop integration code and slightly deferred pause timing. Applications that do not use event-based socket callbacks or do not pause from within them are not exposed and need only the routine library update.

More in Curl

View all
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
CVE-2023-27533 HIGH POC
8.8 Mar 30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2020-8177 HIGH POC
7.8 Dec 14

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead to

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-9080 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy