OpenSSL provider use-after-free
===============================

Project curl Security Advisory, September 2 2026
[Permalink](https://curl.se/docs/CVE-2026-80229.html)

VULNERABILITY
-------------

When performing transfers via libcurl’s multi interface, pooled TLS
connections can outlive their originating easy handles. In OpenSSL 3 provider
configurations, libcurl attaches an allocated library context to the easy
handle's state and passes it to OpenSSL without acquiring an ownership
reference; destroying the easy handle prematurely frees this context while the
active connection retains a dangling pointer, leading to a heap-use-after-free
upon subsequent I/O or post-handshake operations.

INFO
----

OpenSSL 3 providers are only available in libcurl built to use OpenSSL 3+.
None of the popular OpenSSL forks (AWS-LC, BoringSSL and LibreSSL) has
provider support.

This bug is considered a *C mistake* (likely to have been avoided had we not
been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-80229 to this issue.

CWE-416: Use After Free

Severity: low

- Area: OpenSSL
- Original report: https://hackerone.com/reports/3969255

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.14.0 to and including 8.21.0
- Not affected versions: curl < 8.14.0 and >= 8.22.0
- Not affected versions: curl >= 8.20.1 in the 8.20.X branch
- Not affected versions: curl >= 8.16.1 in the 8.16.X branch
- Not affected versions: curl >= 8.14.2 in the 8.14.X branch
- Introduced-in: https://github.com/curl/curl/commit/f2ce6c46b9dcc46ced0ce43f

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/7ea37abc6ac0120ba5f6d9

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

 A - Upgrade curl and libcurl to version 8.22.0

 B - Apply the patch to your version and rebuild

 C - Enable `CURLOPT_FORBID_REUSE` for transfers using providers

TIMELINE
---------

This issue was reported to the curl project on August 24, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!