Is CVE-2026-80229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80229 being exploited in the wild.

How severe is CVE-2026-80229?

High severity, with a CVSS score of 7.5, published 6 September 2026.

Which products and versions are affected?

curl curl 8.14.0 to 8.21.0 (with fixes in 8.14.2, 8.16.1, 8.20.1, 8.22.0).

Is there a fix for CVE-2026-80229?

A patch was published on 2026-09-02: curl 8.22.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80229 attacked?

It is attacked over the network.

Am I affected by CVE-2026-80229?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80229: curl OpenSSL provider use-after-free in TLS connections

CVE-2026-80229 · Severity: high · CVSS 7.5 · Published 2026-09-06

libcurl is a widely-used library for transferring data over networks using HTTP, HTTPS, and other protocols. When using the multi interface with OpenSSL 3 providers, a programming error can cause a freed memory reference to be accessed, leading to application crashes or potential code execution. This affects applications and command-line tools that use libcurl with OpenSSL 3 configured.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-80229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80229 being exploited in the wild.
How severe is CVE-2026-80229?: High severity, with a CVSS score of 7.5, published 6 September 2026.
Which products and versions are affected?: curl curl 8.14.0 to 8.21.0 (with fixes in 8.14.2, 8.16.1, 8.20.1, 8.22.0).
Is there a fix for CVE-2026-80229?: A patch was published on 2026-09-02: curl 8.22.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80229 attacked?: It is attacked over the network.
Am I affected by CVE-2026-80229?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap-use-after-free (CWE-416) in libcurl's TLS connection pooling logic when using the multi interface. When an easy handle is destroyed, libcurl frees an OpenSSL library context that it allocated and attached to the handle without acquiring an ownership reference. However, pooled TLS connections can outlive the easy handle and retain a dangling pointer to this freed context. Subsequent I/O or post-handshake operations on the connection trigger the use-after-free. This occurs only in OpenSSL 3 provider configurations; older OpenSSL versions and forks are unaffected. The vulnerability is reachable via the libcurl multi interface and affects the curl command-line tool as well. Patches are available in curl 8.22.0 and 8.14.2, 8.16.1, and 8.20.1 for earlier branches.

Affected products

curl curl 8.14.0 to 8.21.0 (with fixes in 8.14.2, 8.16.1, 8.20.1, 8.22.0)

Timeline

2026-09-02: disclosed
2026-09-02: patched: curl 8.22.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.