CVE-2026-8925
SASL double-free
9.8 CriticalFix available
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.08%Up 0.8 points since Jul 4, 2026
What each source reports
CVE List Score used
SASL double-free
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
EUVDEUVD-2026-41506
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
EUVD-2026-41506- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p8x5-c6c9-8cwx
The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
GHSA-p8x5-c6c9-8cwx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
NVD
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-8925
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
ALPINE-CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-8925
- Record
BELL-CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSV
SASL double-free
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8925
The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice.
- Record
DEBIAN-CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-1214
The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
JLSEC-2026-1214- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:29017
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:29017- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:34975
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:34975- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8925
The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice.
- Record
UBUNTU-CVE-2026-8925- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCURL-CVE-2026-8925 No score
SASL double-free
The curl logic that works with SASL authentication could end up cleaning up
the GSASL context twice without clearing the pointer in between, making it
free() the same pointer twice.
- Record
CURL-CVE-2026-8925- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11230-1 No score
curl-8.21.0-1.1 on GA media
These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11230-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2026-8925 No score
CVE-2026-8925 in curl - Patched by Root
Root has patched CVE-2026-8925 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-323-CVE-2026-8925- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.23 |
8.15.0 up to 8.22.0-r0 | 8.22.0-r0 |
curlAlpine:v3.24 |
8.15.0 up to 8.21.0-r0 | 8.21.0-r0 |
curlAlpaquita:23 |
8.1.0-r2 up to 8.21.0-r0 | 8.21.0-r0 |
curlAlpaquita:25 |
8.14.0-r1 up to 8.21.0-r0 | 8.21.0-r0 |
curlAlpaquita:stream |
8.1.2-r0 up to 8.21.0-r0 | 8.21.0-r0 |
curlBellSoft Hardened Containers:stream |
8.1.2-r0 up to 8.21.0-r0 | 8.21.0-r0 |
curlDebian:14 |
before 8.21.0~rc2-1, plus listed versions 8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1 Show 45 moreShow less8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5 |
8.21.0~rc2-1 |
CURL_jllJulia |
8.16.0+0 up to 8.21.0+0 | 8.21.0+0 |
LibCURL_jllJulia |
8.15.0+0 up to 8.21.0+0 | 8.21.0+0 |
curlRed Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:8.21.0-0.1.hum1 | 0:8.21.0-0.1.hum1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libcurlRed Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:8.21.0-0.1.hum1 | 0:8.21.0-0.1.hum1 |
libcurl-develRed Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:8.21.0-0.1.hum1 | 0:8.21.0-0.1.hum1 |
libcurl-minimalRed Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:8.21.0-0.1.hum1 | 0:8.21.0-0.1.hum1 |
cargoRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
clippyRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rustRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-analyzerRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-debugger-commonRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-docRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-gdbRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-lldbRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-srcRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-staticRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-aarch64-unknown-none-softfloatRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-aarch64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-i686-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-wasm32-unknown-unknownRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-wasm32-wasip1Red Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-pc-windows-gnuRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-unknown-noneRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rust-std-static-x86_64-unknown-uefiRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
rustfmtRed Hat:hummingbird:1 From an advisory covering 24 CVEs |
before 0:1.96.1-1.hum1 | 0:1.96.1-1.hum1 |
curlUbuntu:22.04:LTS |
before 7.81.0-1ubuntu1.25, plus listed versions 7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1 Show 20 moreShow less7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.207.81.0-1ubuntu1.217.81.0-1ubuntu1.227.81.0-1ubuntu1.237.81.0-1ubuntu1.24 |
7.81.0-1ubuntu1.25 |
curlUbuntu:24.04:LTS |
before 8.5.0-2ubuntu10.10, plus listed versions 8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu18.5.0-2ubuntu2 Show 12 moreShow less8.5.0-2ubuntu88.5.0-2ubuntu98.5.0-2ubuntu108.5.0-2ubuntu10.18.5.0-2ubuntu10.28.5.0-2ubuntu10.38.5.0-2ubuntu10.48.5.0-2ubuntu10.58.5.0-2ubuntu10.68.5.0-2ubuntu10.78.5.0-2ubuntu10.88.5.0-2ubuntu10.9 |
8.5.0-2ubuntu10.10 |
curlUbuntu:25.10 |
before 8.14.1-2ubuntu1.4, plus listed versions 8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.18.14.1-2ubuntu1.28.14.1-2ubuntu1.3 |
8.14.1-2ubuntu1.4 |
curlUbuntu:26.04:LTS |
before 8.18.0-1ubuntu2.2, plus listed versions 8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1 |
8.18.0-1ubuntu2.2 |
curlopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 8.21.0-1.1 | 8.21.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8925 is a critical vulnerability (CVSS 9.8) in Curl, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in curl 8.22.0-r0.
References
curl.se/docs/CVE-2026-8925.json
hackerone.com/reports/3735193
nvd.nist.gov/vuln/detail/CVE-2026-8925
github.com/advisories/GHSA-p8x5-c6c9-8cwx
security.alpinelinux.org/vuln/CVE-2026-8925
Show 194 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-8925
security-tracker.debian.org/tracker/CVE-2026-8925
access.redhat.com/errata/RHSA-2026:29017
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29017.json
bugzilla.redhat.com/show_bug.cgi?id=2496763
cve.org/CVERecord?id=CVE-2026-8286
vuldb.com/cve/CVE-2026-14683
ubuntu.com/security/CVE-2026-8925
suse.com/security/cve/CVE-2026-10536
This page doesn't list everything
Left out here: 9 versions and 9 references. The JSON record has them.