Use-After-Free in libcurl with OpenSSL 3 Provider

Executive Summary

CVE-2026-80229 is a use-after-free flaw in libcurl when using the multi interface with OpenSSL provider configurations. Pooled TLS connections may outlive their originating easy handles. libcurl attaches a library context to the easy handle without proper ownership, causing premature freeing of the context while the connection retains a dangling pointer. This leads to heap-use-after-free during subsequent I/O or post-handshake operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (8.14.0 to 8.21.0) using the command: curl --version. If the version falls within this range, the system is potentially affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition during TLS operations. It primarily affects applications using libcurl's multi interface with OpenSSL 3+ provider configurations, potentially leading to crashes or memory corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-severity technical flaw in libcurl's TLS connection handling. Compliance impacts would only occur if the vulnerability were exploited to cause data breaches or unauthorized access, which is not described in the provided context.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. Alternatively, apply the patch or enable CURLOPT_FORBID_REUSE for transfers using providers to prevent the issue.

Useful 0 Not Useful 0