libcurl UAF via Dangling TLS Context in OpenSSL 3 Multi Interface
CVE-2026-80229 Published on September 6, 2026

OpenSSL provider use-after-free
When performing transfers via libcurls multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

NVD

Vulnerability Analysis

CVE-2026-80229 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-80229 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2026-80229

Want to know whenever a new CVE is published for Haxx Curl? stack.watch will email you.

Haxx Curl
 

Affected Versions

curl: