Use-After-Free in libcurl During Event-Based Socket Callback

Executive Summary

CVE-2026-9080 is a use-after-free vulnerability in libcurl that occurs when the function curl_easy_pause() is called within the event-based CURLMOPT_SOCKETFUNCTION callback.

The problem arises because libcurl tries to store a flag using a struct pointer that has already been freed, leading to a dangling pointer reference.

This is a programming error in C where memory is accessed after it has been released, which can cause undefined behavior or memory corruption.

The vulnerability affects libcurl versions 8.13.0 through 8.20.0 and was fixed in version 8.21.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption due to the use of a dangling pointer after the memory has been freed.

While the severity is rated as low, exploitation could cause instability or crashes in applications using affected libcurl versions.

It does not affect the curl command line tool but impacts programs that use libcurl's event-based socket callback with curl_easy_pause().

Users are advised to upgrade to libcurl version 8.21.0 or later, apply the patch, or avoid calling curl_easy_pause() within the socket callback to mitigate the issue.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a use-after-free issue triggered by calling curl_easy_pause() within the CURLMOPT_SOCKETFUNCTION callback in libcurl. It does not affect the curl command line tool directly.

There are no specific detection commands or network/system scanning methods provided in the available resources for identifying this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade libcurl to version 8.21.0 or later, where the issue has been fixed.

Alternatively, users can apply the patch provided for this issue or avoid calling curl_easy_pause() within the CURLMOPT_SOCKETFUNCTION callback in event-based contexts.

Useful 0 Not Useful 0