# CVE-2026-8925: curl SASL double-free in GSASL context cleanup

Source: https://junglewise.ai/threats/cve-2026-8925-curl-sasl-double-free-in-gsasl-context-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-8925 · Severity: info · CVSS 0 · Published 2026-07-03

A vulnerability exists in curl, a widely used tool and library for transferring data over various network protocols. When using specific email-related protocols like IMAP, POP3, or SMTP with certain authentication settings, the software may attempt to release the same memory location twice. This could lead to an application crash or, in rare circumstances, allow an attacker to disrupt operations or potentially gain unauthorized control over the system.

## Quick answers

**Is CVE-2026-8925 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8925 being exploited in the wild.

**How severe is CVE-2026-8925?** Informational severity, with a CVSS score of 0, published 3 July 2026.

**Which products and versions are affected?** curl curl 8.15.0 to 8.20.0.

**Is there a fix for CVE-2026-8925?** A patch was published on 2026-06-24: Fixed in curl version 8.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8925 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8925?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double-free vulnerability (CWE-415) exists in curl's SASL authentication logic. When curl is built to use libgsasl, the GSASL context can be cleaned up twice without the pointer being cleared in between, resulting in a double call to free(). This issue affects protocols using SASL, including IMAP, POP3, and SMTP. While difficult to exploit for precise memory corruption, the timing and sequence of the free calls can be influenced by server behavior. The vulnerability was introduced in version 8.15.0 and is fixed in version 8.21.0.

## Affected products

- curl curl 8.15.0 to 8.20.0

## Timeline

- 2026-05-14: disclosed: Reported to the curl project via HackerOne
- 2026-06-17: other: Contacted distros@openwall
- 2026-06-24: patched: Fixed in curl version 8.21.0
- 2026-07-03: advisory: NVD publication date

## References

- [https://curl.se/docs/CVE-2026-8925.html](https://curl.se/docs/CVE-2026-8925.html)
- [https://curl.se/docs/CVE-2026-8925.json](https://curl.se/docs/CVE-2026-8925.json)
- [https://hackerone.com/reports/3735193](https://hackerone.com/reports/3735193)