Executive brief
A vulnerability exists in curl, a widely used tool and library for transferring data over various network protocols. When using specific email-related protocols like IMAP, POP3, or SMTP with certain authentication settings, the software may attempt to release the same memory location twice. This could lead to an application crash or, in rare circumstances, allow an attacker to disrupt operations or potentially gain unauthorized control over the system.
Technical details
A double-free vulnerability (CWE-415) exists in curl's SASL authentication logic. When curl is built to use libgsasl, the GSASL context can be cleaned up twice without the pointer being cleared in between, resulting in a double call to free(). This issue affects protocols using SASL, including IMAP, POP3, and SMTP. While difficult to exploit for precise memory corruption, the timing and sequence of the free calls can be influenced by server behavior. The vulnerability was introduced in version 8.15.0 and is fixed in version 8.21.0.
Affected products
- curl curl 8.15.0 to 8.20.0
Timeline
- 2026-05-14: disclosed: Reported to the curl project via HackerOne
- 2026-06-17: other: Contacted distros@openwall
- 2026-06-24: patched: Fixed in curl version 8.21.0
- 2026-07-03: advisory: NVD publication date