Skip to main content

libcurl EUVDEUVD-2026-72167

| CVE-2026-80229 HIGH
Use After Free (CWE-416)
2026-09-02 GHSA-jrp3-jq4v-w9gc
Use After Free Memory Corruption OpenSSL Curl Haxx
7.5
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H reflects the conjunction of OpenSSL 3 provider config, multi interface, and specific easy-handle lifecycle timing required for exploitation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 08, 2026 - 16:40 vuln.today
tag: Information Disclosure removed
Analysis Updated
Sep 08, 2026 - 16:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 08, 2026 - 16:22 vuln.today
cvss_changed
CVSS changed
Sep 08, 2026 - 16:22 NVD
7.5 (HIGH)
Analysis Generated
Sep 02, 2026 - 12:17 vuln.today
CVE Published
Sep 02, 2026 - 10:57 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free in curl OpenSSL TLS Backend - CVE-2026-80229 Sep 02, 2026

AnalysisAI

Heap-use-after-free in libcurl versions 8.14.0 through 8.21.0 allows remote unauthenticated attackers to crash applications performing concurrent TLS transfers via the multi interface. When libcurl builds against OpenSSL 3 with provider configurations, an allocated OpenSSL library context is tied to an easy handle's lifetime without an ownership reference being passed to OpenSSL; if the easy handle is destroyed while a pooled TLS connection remains active, subsequent I/O or post-handshake operations dereference the freed context, triggering a heap-use-after-free. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Three concurrent conditions are required: (1) the application must use libcurl's multi interface (not the simple easy interface) with connection pool reuse enabled - this is the default for multi-handle users; (2) libcurl must be built against OpenSSL 3 with provider-based library context configurations; (3) an easy handle must be destroyed or cleaned up while an associated TLS connection remains active in the multi handle's connection cache, creating the lifetime mismatch. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5), reflecting a remotely triggerable crash with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to a patched version of curl; the exact fixed release is not independently confirmed from the input data, but https://curl.se/docs/CVE-2026-80229.html and https://curl.se/docs/vuln-8.21.0.html should be consulted for the vendor-confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems and applications using libcurl versions 8.14.0-8.21.0, prioritizing production systems and externally-facing services; while no public exploit has been identified at time of analysis, the pervasive library deployment warrants rapid visibility. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:latest Container bci/rust:1.97 Container bci/rust:latest Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.99 Container private-registry/harbor-trivy-adapter:1.1.3-2.117 Container suse/kea:2.6-79.22 Container suse/kiosk/firefox-esr:140.14-75.25 Container suse/postgres:16 Container suse/postgres:16.15 Container suse/postgres:17 Container suse/postgres:17.11 Container suse/postgres:latest Container suse/rmt-server:latest Affected
Container bci/golang:1.25.14-3.72.4 Container bci/golang:1.25.14-openssl-90.8 Container bci/golang:1.26.7-2.73.4 Container bci/golang:1.26.7-openssl-90.8 Container bci/node:22 Container bci/openjdk:17 Container bci/openjdk:21 Container bci/openjdk:latest Container bci/python:3 Container bci/python:latest Container bci/ruby:2 Container bci/ruby:latest Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.154 Container suse/sle15:latest Affected
Container suse/ltss/sle15.6/sle15:15.6-5.89 Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

Share

EUVD-2026-72167 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy