Executive brief
libcurl is a widely-used library for transferring data over networks using HTTP, HTTPS, and other protocols. When using the multi interface with OpenSSL 3 providers, a programming error can cause a freed memory reference to be accessed, leading to application crashes or potential code execution. This affects applications and command-line tools that use libcurl with OpenSSL 3 configured.
Technical details
The vulnerability is a heap-use-after-free (CWE-416) in libcurl's TLS connection pooling logic when using the multi interface. When an easy handle is destroyed, libcurl frees an OpenSSL library context that it allocated and attached to the handle without acquiring an ownership reference. However, pooled TLS connections can outlive the easy handle and retain a dangling pointer to this freed context. Subsequent I/O or post-handshake operations on the connection trigger the use-after-free. This occurs only in OpenSSL 3 provider configurations; older OpenSSL versions and forks are unaffected. The vulnerability is reachable via the libcurl multi interface and affects the curl command-line tool as well. Patches are available in curl 8.22.0 and 8.14.2, 8.16.1, and 8.20.1 for earlier branches.
Affected products
- curl curl 8.14.0 to 8.21.0 (with fixes in 8.14.2, 8.16.1, 8.20.1, 8.22.0)
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: curl 8.22.0 released