{"id":"CVE-2026-80229","aliases":["ALPINE-CVE-2026-80229","AZL-99795","AZL-99837","AZL-99867","BELL-CVE-2026-80229","CURL-CVE-2026-80229","DEBIAN-CVE-2026-80229","EUVD-2026-72167","GHSA-jrp3-jq4v-w9gc","MGASA-2026-0515","RHSA-2026:63161","ROOT-OS-ALPINE-320-CVE-2026-80229","ROOT-OS-ALPINE-321-CVE-2026-80229","ROOT-OS-ALPINE-322-CVE-2026-80229","ROOT-OS-DEBIAN-13-CVE-2026-80229","SUSE-SU-2026:23498-1","SUSE-SU-2026:23521-1","SUSE-SU-2026:23638-1","SUSE-SU-2026:3958-1","SUSE-SU-2026:4047-1","SUSE-SU-2026:4048-1","SUSE-SU-2026:4071-1","UBUNTU-CVE-2026-80229","USN-8820-1","openSUSE-SU-2026:11696-1","openSUSE-SU-2026:21774-1"],"status":"published","title":"OpenSSL provider use-after-free","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00563,"percentile":0.47091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-09-02T08:00:00Z","modified":"2026-11-03T12:15:07Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.22.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r30078","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r30078","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r400710","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r400710","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"curl","fixed_in":["8.20.0-2ubuntu11"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.46-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.75.0-31"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.90.0-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0~rc3-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.23.0-1.mga10"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.91.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.51.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.129.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0-2ubuntu11"}]}],"versions":["8.18.0-1ubuntu2","8.20.0-2ubuntu1","8.20.0-2ubuntu3","8.20.0-2ubuntu10"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.7"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1","8.18.0-1ubuntu2.2","8.18.0-1ubuntu2.3","8.18.0-1ubuntu2.4","8.18.0-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.19+esm20"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14","7.47.0-1ubuntu2.15","7.47.0-1ubuntu2.16","7.47.0-1ubuntu2.18","7.47.0-1ubuntu2.19","7.47.0-1ubuntu2.19+esm1","7.47.0-1ubuntu2.19+esm2","7.47.0-1ubuntu2.19+esm3","7.47.0-1ubuntu2.19+esm4","7.47.0-1ubuntu2.19+esm5","7.47.0-1ubuntu2.19+esm6","7.47.0-1ubuntu2.19+esm7","7.47.0-1ubuntu2.19+esm8","7.47.0-1ubuntu2.19+esm9","7.47.0-1ubuntu2.19+esm10","7.47.0-1ubuntu2.19+esm11","7.47.0-1ubuntu2.19+esm12","7.47.0-1ubuntu2.19+esm13","7.47.0-1ubuntu2.19+esm15","7.47.0-1ubuntu2.19+esm16","7.47.0-1ubuntu2.19+esm17","7.47.0-1ubuntu2.19+esm18"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.24+esm14"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8","7.58.0-2ubuntu3.9","7.58.0-2ubuntu3.10","7.58.0-2ubuntu3.12","7.58.0-2ubuntu3.13","7.58.0-2ubuntu3.14","7.58.0-2ubuntu3.15","7.58.0-2ubuntu3.16","7.58.0-2ubuntu3.17","7.58.0-2ubuntu3.18","7.58.0-2ubuntu3.19","7.58.0-2ubuntu3.20","7.58.0-2ubuntu3.21","7.58.0-2ubuntu3.22","7.58.0-2ubuntu3.23","7.58.0-2ubuntu3.24","7.58.0-2ubuntu3.24+esm1","7.58.0-2ubuntu3.24+esm2","7.58.0-2ubuntu3.24+esm3","7.58.0-2ubuntu3.24+esm4","7.58.0-2ubuntu3.24+esm5","7.58.0-2ubuntu3.24+esm7","7.58.0-2ubuntu3.24+esm8","7.58.0-2ubuntu3.24+esm9","7.58.0-2ubuntu3.24+esm10","7.58.0-2ubuntu3.24+esm11","7.58.0-2ubuntu3.24+esm12"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.25+esm9"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2","7.68.0-1ubuntu2.1","7.68.0-1ubuntu2.2","7.68.0-1ubuntu2.4","7.68.0-1ubuntu2.5","7.68.0-1ubuntu2.6","7.68.0-1ubuntu2.7","7.68.0-1ubuntu2.10","7.68.0-1ubuntu2.11","7.68.0-1ubuntu2.12","7.68.0-1ubuntu2.13","7.68.0-1ubuntu2.14","7.68.0-1ubuntu2.15","7.68.0-1ubuntu2.16","7.68.0-1ubuntu2.18","7.68.0-1ubuntu2.19","7.68.0-1ubuntu2.20","7.68.0-1ubuntu2.21","7.68.0-1ubuntu2.22","7.68.0-1ubuntu2.23","7.68.0-1ubuntu2.24","7.68.0-1ubuntu2.25","7.68.0-1ubuntu2.25+esm2","7.68.0-1ubuntu2.25+esm3","7.68.0-1ubuntu2.25+esm4","7.68.0-1ubuntu2.25+esm5","7.68.0-1ubuntu2.25+esm6","7.68.0-1ubuntu2.25+esm7"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.29"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21","7.81.0-1ubuntu1.22","7.81.0-1ubuntu1.23","7.81.0-1ubuntu1.24","7.81.0-1ubuntu1.25","7.81.0-1ubuntu1.26","7.81.0-1ubuntu1.27"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.15"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6","8.5.0-2ubuntu10.7","8.5.0-2ubuntu10.8","8.5.0-2ubuntu10.9","8.5.0-2ubuntu10.10","8.5.0-2ubuntu10.11","8.5.0-2ubuntu10.12","8.5.0-2ubuntu10.13"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.7"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1","8.18.0-1ubuntu2.2","8.18.0-1ubuntu2.3","8.18.0-1ubuntu2.4","8.18.0-1ubuntu2.5"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.9.1"}]}],"bundled":6}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-80229.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-80229.html","tags":["Patch","Vendor Advisory","web","article","report"]},{"url":"https://hackerone.com/reports/3969255","tags":["Exploit","Mitigation","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80229","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jrp3-jq4v-w9gc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-80229","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-80229","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80229.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-80229","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0515.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36250","tags":["report"]},{"url":"https://curl.se/docs/security.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63161","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19931","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13608","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82209","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80255","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63161.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13608","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-13608.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-13608.json","tags":["article"]},{"url":"https://hackerone.com/reports/3822248","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-18924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-18924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3916059","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-19931.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-19931.json","tags":["article"]},{"url":"https://hackerone.com/reports/3923520","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80229","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80230.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80230.json","tags":["article"]},{"url":"https://hackerone.com/reports/3969300","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80231.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80231.json","tags":["article"]},{"url":"https://hackerone.com/reports/3969368","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80255","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-80255.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-80255.json","tags":["article"]},{"url":"https://hackerone.com/reports/3972395","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-82209.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-82209.json","tags":["article"]},{"url":"https://hackerone.com/reports/3972385","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623498-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262633","tags":["report"]},{"url":"https://bugzilla.suse.com/1263440","tags":["report"]},{"url":"https://bugzilla.suse.com/1268412","tags":["report"]},{"url":"https://bugzilla.suse.com/1277476","tags":["report"]},{"url":"https://bugzilla.suse.com/1277479","tags":["report"]},{"url":"https://bugzilla.suse.com/1277480","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623521-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623638-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263958-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264971","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264047-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264071-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-80229","tags":["report"]},{"url":"https://github.com/curl/curl/commit/7ea37abc6ac0120ba5f6d9","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8820-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-13608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-18924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-82209","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82209","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-80229","title":"OpenSSL provider use-after-free","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T17:47:59.51Z","modified":"2026-09-15T06:03:08.881Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416","CWE-416"],"updated_at":"2026-11-02T13:45:36.695039Z"}],"euvd":[{"id":"EUVD-2026-72167","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T17:47:59Z","modified":"2026-09-15T06:03:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-jrp3-jq4v-w9gc","title":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their...","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:34:39Z","modified":"2026-09-08T18:32:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:11:31.661331Z"}],"nvd":[{"id":"CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22.217Z","modified":"2026-09-15T07:16:30.157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"ALPINE-CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22.217Z","modified":"2026-10-01T02:17:49.413013182Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-80229","status":"published","published":"2026-09-04T06:05:07.755516Z","modified":"2026-09-10T07:15:06.291691543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-80229","title":"OpenSSL provider use-after-free","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T17:47:59.51Z","modified":"2026-10-28T10:55:36.814220725Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22.217Z","modified":"2026-10-01T03:03:42.502213646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"RHSA-2026:63161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:17:20Z","modified":"2026-10-20T10:43:35.797896375Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-80229","description":"When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:00Z","modified":"2026-10-17T13:01:10.298676259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-99795","title":"CVE-2026-80229 affecting package mysql 8.0.46-1","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:41:18.902405Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99837","title":"CVE-2026-80229 affecting package rust 1.75.0-31","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-14T05:26:59Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99867","title":"CVE-2026-80229 affecting package rust 1.90.0-10","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-06T18:17:22Z","modified":"2026-09-08T12:41:47.900445Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"CURL-CVE-2026-80229","title":"OpenSSL provider use-after-free","description":"When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.","status":"published","published":"2026-09-02T08:00:00Z","modified":"2026-10-26T13:07:43.340610703Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2026-0515","title":"Updated curl package fixes security vulnerabilities","description":"curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at\nhttps://curl.se/docs/security.html\nNot all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these\nare the ones that do:\nCVE-2026-86410: redirect to SFTP or SCP bypasses host verification\nCVE-2026-86412: server-set cookie erases cookie jar\nCVE-2026-86413: Negotiate credentials sent to redirected origin\nCVE-2026-86414: leaking host credentials to HTTP proxy\nCVE-2026-86415: auto client cert connection reuse mixup\nCVE-2026-87861: cross-origin reuse of a Negotiate connection\nCVE-2026-87862: HSTS cache import drops longer-lived child\nCVE-2026-87863: HSTS response erases persisted entries\nCVE-2026-92386: server-set cookie aborts cookie jar load\nCVE-2026-92387: never-ending loop via server response omission\nCVE-2026-92388: FTP wildcard write callback mixup\nCVE-2026-92389: TFTP direction confusion\nCVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints\nCVE-2026-92391: curl_mime_free stack overflow by recursion\nCVE-2026-92392: HTTP/2 upload Use-After-Free\nCVE-2026-94265: Authorization: Negotiate sent to foreign origin\nCVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL\nCVE-2026-107929: local interface connection reuse mixup\nThere were also some CVE IDs released at the same time that were fixed\nearlier, in 8.22.0, but just announced now:\nCVE-2026-86409: stale SigV4 headers sent unintended\nCVE-2026-86411: FTP connection reuse inherits client-certificate\nCVE-2026-87864: IMAP APPEND plus CRLF conversion command injection\nHere are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so\nare only getting fixed now:\nCVE-2026-13608: OpenLDAP SASL authentication bypass\nCVE-2026-18924: HTTP/2 server push UAF\nCVE-2026-19931: Negotiate ambient user conn reuse\nCVE-2026-80229: OpenSSL provider use-after-free\nCVE-2026-80230: OpenSSL pinning bypass\nCVE-2026-80255: secure cookie attribute bypass with tab\nCVE-2026-82209: domain-scoped PSL domain cookie\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:43:01.411193688Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11696-1","title":"curl-8.22.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.876145789Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21774-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:56:18Z","modified":"2026-09-09T18:23:14.977934943Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-80229","title":"CVE-2026-80229 in curl - Patched by Root","description":"Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:11.996025956Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-80229","title":"CVE-2026-80229 in curl - Patched by Root","description":"Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:07.060932839Z","updated_at":"2026-11-03T12:31:35.467775Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-80229","title":"CVE-2026-80229 in curl - Patched by Root","description":"Root has patched CVE-2026-80229 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:06.940926803Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-80229","title":"CVE-2026-80229 in curl - Patched by Root","description":"Root has patched CVE-2026-80229 in the curl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:50:30Z","modified":"2026-11-03T11:15:08.327469099Z","updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"SUSE-SU-2026:23498-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-14T18:23:13.86762477Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23521-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n","status":"published","published":"2026-09-04T09:08:38Z","modified":"2026-09-15T18:23:09.020509501Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23638-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).\n- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).\n","status":"published","published":"2026-09-06T16:57:12Z","modified":"2026-09-29T18:23:10.493555771Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3958-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-03T13:32:12Z","modified":"2026-09-13T18:23:12.410814638Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4047-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).\n- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).\n- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n\nChanges for curl:\n\n- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero\n Content-Length empty body check (bsc#1264971)\n","status":"published","published":"2026-09-07T13:53:51Z","modified":"2026-09-13T18:23:18.224672627Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4048-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n","status":"published","published":"2026-09-07T13:54:13Z","modified":"2026-09-13T18:23:18.256605275Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4071-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).\n- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).\n- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).\n","status":"published","published":"2026-09-08T07:06:12Z","modified":"2026-09-13T18:23:19.864140343Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8820-1","title":"curl vulnerabilities","description":"Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for\nLDAP authentication in certain circumstances. A machine-in-the-middle\nattacker could possibly use this issue to bypass peer validation. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-13608)\n\nStephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server\nPush streams when sharing connections between handles. A remote attacker\ncould possibly use this issue to cause curl to crash, resulting in a denial\nof service, or execute arbitrary code. (CVE-2026-18924)\n\nStanislav Fort discovered that curl incorrectly managed the lifetime of\npooled TLS connections when using the multi interface. An attacker could\npossibly use this issue to cause curl to crash, resulting in a denial of\nservice, or execute arbitrary code. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-80229)\n\nStanislav Fort discovered that curl did not properly enforce public key\npinning when certificate verification was disabled in certain\ncircumstances. A remote attacker could possibly use this issue to bypass\npinning checks and cause curl to accept connections that should have been\nrejected. (CVE-2026-80230)\n\nStanislav Fort discovered that curl incorrectly handled the Secure\nattribute of cookies in certain circumstances. A remote attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-80255)\n\nStanislav Fort discovered that curl did not properly enforce Public\nSuffix List boundaries when handling cookies in certain circumstances. A\nremote attacker could possibly use this issue to cause cookies to be sent\nto unrelated domains, resulting in sensitive information being exposed.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)\n\nAdy Elouej discovered that curl did not clear proxy authentication state\nbetween requests when reusing a handle with environment-variable proxy\nconfiguration. A remote attacker could possibly use this issue to obtain\nsensitive credentials. This issue was previously fixed in USN-8487-1, but\nthat fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)","status":"published","published":"2026-09-24T20:13:19Z","modified":"2026-09-26T04:41:35.074747182Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}