CVE-2026-9080
Discovered by AISLEPUBLISHEDCWE-416
Description
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
CVSS Base Scores
CVSS v3.1(Primary)
7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| curl | curl | 8.13.0 | affected |
| curl | curl | 8.15.0 | affected |
| curl | curl | 8.17.0 | affected |
| curl | curl | cfc657a48dbafb4194676d4c9d841388b3a22210 | affected |
| curl | curl | 8.20.0 | affected |
| curl | curl | 8.19.0 | affected |
| curl | curl | 8.18.0 | affected |
| curl | curl | 8.17.0 | affected |
| curl | curl | 8.16.0 | affected |
| curl | curl | 8.15.0 | affected |
| curl | curl | 8.14.1 | affected |
| curl | curl | 8.14.0 | affected |
| curl | curl | 8.13.0 | affected |
Credits
- Joshua Rogers (Aisle Research)(finder)
- Joshua Rogers (Aisle Research)(remediation developer)
- Daniel Stenberg(remediation developer)