CVE-2026-80229: OpenSSL provider use-after-free

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-09-06 · updated 2026-09-15
Weakness: CWE-416

Description

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

Affected products

curl: from 8.14.0 before 8.22.0 — fixed in 8.22.0

How to fix

Upgrade to a fixed version: curl 8.22.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-80229 or the next vulnerability affects your stack