Is CVE-2026-8925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8925 being exploited in the wild.

How severe is CVE-2026-8925?

Informational severity, with a CVSS score of 0, published 3 July 2026.

Is there a fix for CVE-2026-8925?

A patch was published on 2026-06-24: Fixed in curl version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8925 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8925?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8925: curl SASL double-free in GSASL context cleanup

CVE-2026-8925 · Severity: info · CVSS 0 · Published 2026-07-03

A vulnerability exists in curl, a widely used tool and library for transferring data over various network protocols. When using specific email-related protocols like IMAP, POP3, or SMTP with certain authentication settings, the software may attempt to release the same memory location twice. This could lead to an application crash or, in rare circumstances, allow an attacker to disrupt operations or potentially gain unauthorized control over the system.

Quick answers

Is CVE-2026-8925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8925 being exploited in the wild.
How severe is CVE-2026-8925?: Informational severity, with a CVSS score of 0, published 3 July 2026.
Which products and versions are affected?: curl curl 8.15.0 to 8.20.0.
Is there a fix for CVE-2026-8925?: A patch was published on 2026-06-24: Fixed in curl version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8925 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8925?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability (CWE-415) exists in curl's SASL authentication logic. When curl is built to use libgsasl, the GSASL context can be cleaned up twice without the pointer being cleared in between, resulting in a double call to free(). This issue affects protocols using SASL, including IMAP, POP3, and SMTP. While difficult to exploit for precise memory corruption, the timing and sequence of the free calls can be influenced by server behavior. The vulnerability was introduced in version 8.15.0 and is fixed in version 8.21.0.

Affected products

curl curl 8.15.0 to 8.20.0

Timeline

2026-05-14: disclosed: Reported to the curl project via HackerOne
2026-06-17: other: Contacted distros@openwall
2026-06-24: patched: Fixed in curl version 8.21.0
2026-07-03: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.