CVE-2026-9080 Details
Description
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
A use-after-free vulnerability has been identified in libcurl versions 8.13.0 through 8.20.0. This issue arises when 'curl_easy_pause()' is called within the 'CURLMOPT_SOCKETFUNCTION' callback. The function call leads to a premature release of memory, creating a dangling pointer. Subsequently, libcurl attempts to use this freed memory to store a flag, resulting in a heap-use-after-free condition. This vulnerability was introduced in version 8.13.0 and is confirmed to be present in the latest version 8.20.0.
Users are advised to upgrade libcurl to version 8.21.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3749204 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-9080.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-9080.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3749204 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-416 | Use After Free | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.13.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |