Vulnerability Details CVE-2026-80229
When performing transfers via libcurl’s multi interface, pooled TLS
connections can outlive their originating easy handles. In OpenSSL 3 provider
configurations, libcurl attaches an allocated library context to the easy
handle's state and passes it to OpenSSL without acquiring an ownership
reference; destroying the easy handle prematurely frees this context while the
active connection retains a dangling pointer, leading to a heap-use-after-free
upon subsequent I/O or post-handshake operations.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 57.7%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-80229
-
cpe:2.3:a:haxx:curl:8.14.0
-
cpe:2.3:a:haxx:curl:8.14.1
-
cpe:2.3:a:haxx:curl:8.15.0
-
cpe:2.3:a:haxx:curl:8.16.0
-
cpe:2.3:a:haxx:curl:8.17.0
-
cpe:2.3:a:haxx:curl:8.18.0
-
cpe:2.3:a:haxx:curl:8.19.0
-
cpe:2.3:a:haxx:curl:8.20.0
-
cpe:2.3:a:haxx:curl:8.21.0