Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-8925

SASL double-free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.15.0 to < 8.16.1affected
  • 8.17.0 to < 8.20.1affected

curl curl

Default version status: unaffected

  • ab650379a8c25ca952f651476d25b4cdd77bb3fc to < 3da249e1f0716c06644ed3522a37a8bf81808012affected

curl curl

Default version status: unaffected

  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected
  • 8.16.0affected
  • 8.15.0affected

References