CVE-2026-80229: 
cURL vulnerability analysis and mitigation

CVE-2026-80229 is a heap-use-after-free vulnerability in libcurl's multi interface when using OpenSSL 3 provider configurations, classified as "OpenSSL provider use-after-free." It affects curl versions 8.14.0 through 8.21.0 (inclusive); versions prior to 8.14.0 and 8.22.0 or later are not affected. The vulnerability was reported on August 24, 2026, and publicly disclosed on September 2, 2026, coinciding with the release of curl 8.22.0. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the curl project itself rates the severity as Low (curl Advisory, GitHub Advisory).

The root cause is a CWE-416 (Use After Free) memory management error in libcurl's handling of OpenSSL 3 provider library contexts. When transfers are performed via libcurl's multi interface, pooled TLS connections can outlive their originating easy handles; libcurl attaches an allocated OpenSSL library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference. When the easy handle is destroyed prematurely, this context is freed while the active pooled connection retains a dangling pointer, triggering a heap-use-after-free on subsequent I/O or post-handshake operations. This flaw is specific to libcurl built against OpenSSL 3+ and does not affect OpenSSL forks; it also affects the curl command-line tool. The vulnerability was introduced at commit f2ce6c46b9dcc46ced0ce43fa95176ea7599a854 and fixed at 7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb (curl Advisory, curl JSON).

Successful exploitation causes a heap-use-after-free condition that can crash or destabilize applications using libcurl, resulting in a denial of service. The vulnerability is network-exploitable without authentication or user interaction, meaning any application using libcurl's multi interface with OpenSSL 3 providers and connection pooling is potentially reachable by a remote attacker. The CVSS assessment indicates no confidentiality or integrity impact — the primary consequence is availability loss (curl Advisory, GitHub Advisory).

No confirmed public exploit or proof-of-concept code is available; the HackerOne report (report #3969255) is a technical vulnerability analysis without concrete reproduction steps or attack payloads (HackerOne). There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0022 (0.22%), indicating a low probability of exploitation in the near term. The NVD SSVC assessment marks exploitation as "none" with automatable attack surface (GitHub Advisory).

The primary remediation is to upgrade curl and libcurl to version 8.22.0 or later, which contains the fix (curl Advisory). Backported fixes are also available in versions 8.14.2, 8.16.1, and 8.20.1 for users who cannot upgrade to the latest release. As a configuration-based workaround, enabling CURLOPT_FORBID_REUSE for transfers using OpenSSL 3 providers prevents connection pooling and eliminates the lifetime mismatch that triggers the vulnerability. SUSE has issued security updates (SUSE-SU-2026:3958-1, SUSE-SU-2026:4048-1, SUSE-SU-2026:4071-1) for affected distributions (SUSE Advisory).

The vulnerability was discovered by Stanislav Fort of Aisle Research, which published a blog post noting that their AI-assisted research identified six curl CVEs — a finding that attracted attention given that other AI systems (OpenAI, Anthropic) had reportedly found none (Aisle Blog). curl maintainer Daniel Stenberg acknowledged the fix in the curl 8.22.0 release blog post and served as the remediation developer (Daniel Stenberg Blog). The disclosure was coordinated through the oss-security mailing list and HackerOne, following curl's standard vulnerability disclosure process (oss-sec).