CVE-2026-80229

Modified Modified - Updated After Analysis

Use-After-Free in libcurl with OpenSSL 3 Provider

Publication date: 2026-09-06

Last updated on: 2026-09-15

Assigner: curl

Description

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-15

Generated

2026-09-28

AI Q&A

2026-09-06

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80229

EUVD

EUVD-2026-72167

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 8.14.0 (inc) to 8.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-80229 is a use-after-free flaw in libcurl when using the multi interface with OpenSSL provider configurations. Pooled TLS connections may outlive their originating easy handles. libcurl attaches a library context to the easy handle without proper ownership, causing premature freeing of the context while the connection retains a dangling pointer. This leads to heap-use-after-free during subsequent I/O or post-handshake operations.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (8.14.0 to 8.21.0) using the command: curl --version. If the version falls within this range, the system is potentially affected.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition during TLS operations. It primarily affects applications using libcurl's multi interface with OpenSSL 3+ provider configurations, potentially leading to crashes or memory corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-severity technical flaw in libcurl's TLS connection handling. Compliance impacts would only occur if the vulnerability were exploited to cause data breaches or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. Alternatively, apply the patch or enable CURLOPT_FORBID_REUSE for transfers using providers to prevent the issue.

Hi! I’m here to help you understand CVE-2026-80229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70