curl / Docs / curl CVEs / OpenSSL provider use-after-free
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-80229

OpenSSL provider use-after-free

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

INFO

OpenSSL 3 providers are only available in libcurl built to use OpenSSL 3+. No OpenSSL fork has them.

This bug is considered a C mistake (likely to have been avoided had we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-80229 to this issue.

CWE-416: Use After Free

Severity: low

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Enable CURLOPT_FORBID_REUSE for transfers using providers

TIMELINE

This issue was reported to the curl project on August 24, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!