CVE-2026-80229

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie

These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
• CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
• CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
• CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
• CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-80229 in the curl package for Root:Debian:13. Multiple fixed versions available.

This update for curl fixes the following issues:

• CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
• CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
• CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
• CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
• CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

This update for curl fixes the following issues:

• CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
• CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

This update for curl fixes the following issues:

• CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
• CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
• CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
• CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
• CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

This update for curl fixes the following issues:

• CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
• CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
• CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
• CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
• CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Changes for curl:

• Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)

This update for curl fixes the following issues:

• CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
• CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
• CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
• CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
• CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Changes for curl:

• Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)

This update for curl fixes the following issues:

• CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
• CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

This update for curl fixes the following issues:

• CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
• CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
• CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate verification was disabled in certain circumstances. A remote attacker could possibly use this issue to bypass pinning checks and cause curl to accept connections that should have been rejected. (CVE-2026-80230)

Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)

Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)