CVE-2026-80229 | BDVDB-2026-368598 Detail

Description#

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-06Record published in the CVE List.
2. Version 22026-09-15Most recent update recorded in the CVE List.