CVE-2026-8925
Received Received - Intake

Double Free in cURL with SASL Authentication

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: curl

Description
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-03
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-8925
EUVD
EUVD-2026-41506

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
curl curl From 8.15.0 (inc) to 8.20.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-8925 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

The CVE-2026-8925 vulnerability in curl is a double-free issue in the SASL authentication logic. Specifically, when curl processes SASL authentication, it may free the same memory pointer twice without clearing it in between. This happens because the GSASL context is cleaned up twice, leading to a double-free condition.

Impact Analysis

This vulnerability could potentially be exploited in limited scenarios to cause unexpected behavior such as crashes or memory corruption in applications using vulnerable versions of curl. However, the practical impact is uncertain and likely limited. The issue affects curl versions 8.15.0 through 8.20.0 and was fixed in version 8.21.0.

Mitigation Strategies

To mitigate the CVE-2026-8925 vulnerability, users should upgrade curl to version 8.21.0 or later, where the double-free issue in the SASL authentication logic has been fixed.

Alternatively, users can apply the patch released on June 24, 2026, that addresses this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8925. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart