Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-9080

UAF after pause in socket callback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 8.13.0 to < 8.14.2affected
  • 8.15.0 to < 8.16.1affected
  • 8.17.0 to < 8.20.1affected

curl curl

Default version status: unaffected

  • cfc657a48dbafb4194676d4c9d841388b3a22210 to < 5ab34cba42e4ee4282fe8bab43f311d51b9bf9bdaffected

curl curl

Default version status: unaffected

  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected
  • 8.16.0affected
  • 8.15.0affected
  • 8.14.1affected
  • 8.14.0affected
  • 8.13.0affected

References