CVE-2026-80229

CVE-2026-80229 is a heap-use-after-free (CWE-416) in libcurl's TLS connection handling, where pooled TLS connections can outlive the easy handles that created them when transfers are performed through the multi interface. In libcurl builds configured for OpenSSL 3 providers, the library attaches an allocated OpenSSL library context to the easy handle's state and hands it to OpenSSL without acquiring an ownership reference, so destroying the easy handle frees the context while the pooled connection still holds a dangling pointer; any subsequent I/O or post-handshake operation on that connection dereferences freed memory. An attacker who can influence connection reuse and handle lifetime in such an application can crash the process, causing a denial of service; per the CVSS 3.1 vector (C:N/I:N/A:H) the scored impact is availability only, with no direct confidentiality or integrity impact. Affected users are anyone running software that embeds or links libcurl and performs multi-interface transfers under OpenSSL 3 provider configurations, a very large population since libcurl ships by default in virtually every Linux distribution and countless applications and devices. There is currently no evidence of exploitation: no public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS estimates about a 0.6% probability of exploitation within 30 days.

What to do: Monitor your distribution or vendor for the patched libcurl release and upgrade promptly; no fixed version number is provided in the available data, so do not assume your current build is safe. In the meantime, audit whether your applications link libcurl against OpenSSL 3 provider configurations and use the multi interface, and as an interim mitigation avoid destroying easy handles while their pooled TLS connections remain active for reuse, or reconfigure curl away from OpenSSL 3 provider mode where feasible.