CVE-2026-9080: 
cURL vulnerability analysis and mitigation

CVE-2026-9080 is a use-after-free (UAF) vulnerability in libcurl titled "UAF after pause in socket callback," affecting curl versions 8.13.0 through 8.20.0 (inclusive). The flaw was reported to the curl project on May 19, 2026, by Joshua Rogers of Aisle Research, and was publicly disclosed on June 24, 2026, coordinated with the release of curl 8.21.0. It carries a CVSS v3.1 base score of 7.3 (High) (GitHub Advisory, curl Advisory). Notably, the curl project itself rates the severity as "Low" due to the specific triggering conditions required (curl Advisory).

The vulnerability (CWE-416: Use After Free) is introduced in commit cfc657a48d and exists in libcurl's event-based multi-socket interface. When curl_easy_pause() is called from within a CURLMOPT_SOCKETFUNCTION callback, the socket transitions from POLL_OUT to POLL_IN (request sent, response pending), causing mev_forget_socket() to free the mev_sh_entry struct. Immediately afterward, mev_sh_entry_update() attempts to write a flag to that now-freed memory, resulting in a heap use-after-free condition (curl Advisory, HackerOne PoC). The vulnerability does not affect the curl command-line tool — only applications using libcurl's multi-socket API with a custom socket callback (curl Advisory).

Successful exploitation can result in low-impact confidentiality, integrity, and availability consequences, including potential arbitrary code execution, memory disclosure, or application crash, depending on heap layout and attacker control (GitHub Advisory). An unauthenticated remote attacker can trigger the vulnerability by sending network requests that cause the affected callback sequence to execute in a vulnerable application (Feedly). The scope is limited to applications that explicitly use libcurl's event-driven multi-socket interface with CURLMOPT_SOCKETFUNCTION and call curl_easy_pause() within that callback (curl Advisory).

1. Identify vulnerable targets: Locate applications using libcurl versions 8.13.0–8.20.0 that implement the multi-socket event-driven API with a CURLMOPT_SOCKETFUNCTION callback and call curl_easy_pause() within that callback.
2. Compile the PoC: Obtain the public PoC from HackerOne report #3749204 and compile it with ASAN enabled: cc -g -fsanitize=address -fno-omit-frame-pointer poc_uaf.c -Iinclude -Ibuild-asan/lib -Lbuild-asan/lib -lcurl-d.
3. Trigger the callback sequence: Send a network request to the target application such that libcurl transitions the socket state from POLL_OUT to POLL_IN (i.e., after the HTTP request is sent and the response is pending).
4. Invoke the UAF: The CURLMOPT_SOCKETFUNCTION callback fires; curl_easy_pause(easy, CURLPAUSE_RECV) is called within it, causing mev_forget_socket() to free the mev_sh_entry struct while mev_sh_entry_update() still holds a reference to it.
5. Achieve impact: The dangling pointer write corrupts heap memory, potentially leading to a crash (DoS), memory disclosure, or — with heap grooming — arbitrary code execution in the context of the libcurl-using process (HackerOne PoC, curl Advisory).

• Process: Application crashes or unexpected termination in processes using libcurl's multi-socket API, particularly those with custom CURLMOPT_SOCKETFUNCTION callbacks; ASAN/heap sanitizer reports referencing mev_sh_entry or mev_forget_socket.
• Logs: Application error logs showing segmentation faults, heap corruption errors, or double-free messages originating from libcurl internals during socket state transitions.
• Network: Unusual or repeated connection patterns to a libcurl-based service that correlate with application instability or crashes, potentially indicating exploitation attempts.
• File System: Presence of the PoC file poc_uaf.c or compiled binaries targeting libcurl on attacker-controlled or compromised systems (HackerOne PoC).

The primary remediation is to upgrade libcurl to version 8.21.0 or later, which contains the fix introduced in commit 5ab34cba42e4ee4282fe (curl Advisory). If immediate patching is not feasible, the curl project recommends avoiding calls to curl_easy_pause() from within the CURLMOPT_SOCKETFUNCTION callback as a workaround (curl Advisory). Alternatively, the patch can be applied manually and libcurl rebuilt from source. Organizations using Red Hat products should monitor the Red Hat Bugzilla entry (Bug 2496755) for distribution-specific package updates (Red Hat Bugzilla).

The curl 8.21.0 release was notable as a record-breaking security release, patching 18 CVEs simultaneously, including a 25-year-old vulnerability, which attracted significant media coverage (SecurityWeek, Security Affairs). Daniel Stenberg (curl's lead developer) published a blog post announcing the 8.21.0 release (Daniel Stenberg Blog). Aisle Research, the firm that discovered CVE-2026-9080 and several other CVEs in this batch, published a blog post highlighting their findings (Aisle Research). The release generated broad community discussion given the scale of the patch batch and the involvement of AI-assisted vulnerability discovery.