35
CVE-2026-9080
PoC —CVSS 3.1
7.3 high
EPSS
<1%p22
Published
()
Modified
Description
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
- Vendors
- haxx
- Products
- curl
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L