CVE-2026-80229
Description
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2026-80229 NameCVE-2026-80229 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus curl (PTS)bookworm7.88.1-10+deb12u15fixed bookworm (security)7.88.1-10+deb12u5fixed…
CVE-2026-80229
| Name | CVE-2026-80229 |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| curl (PTS) | bookworm | 7.88.1-10+deb12u15 | fixed |
| bookworm (security) | 7.88.1-10+deb12u5 | fixed | |
| trixie | 8.14.1-2+deb13u4 | vulnerable | |
| forky | 8.21.0-2 | vulnerable | |
| sid | 8.22.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| curl | source | bookworm | (not affected) | |||
| curl | source | (unstable) | 8.22.0~rc3-1 |
Notes
[trixie] - curl <no-dsa> (Minor issue)
[bookworm] - curl <not-affected> (Vulnerable code introduced later)
https://curl.se/docs/CVE-2026-80229.html
Introduced with: https://github.com/curl/curl/commit/f2ce6c46b9dcc46ced0ce43fa95176ea7599a854 (rc-8_14_0-1)
Fixed by: https://github.com/curl/curl/commit/7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb (rc-8_22_0-3)
Apply commands
[trixie] - curl <no-dsa> (Minor issue)[bookworm] - curl <not-affected> (Vulnerable code introduced later)https://curl.se/docs/CVE-2026-80229.htmlIntroduced with: https://github.com/curl/curl/commit/f2ce6c46b9dcc46ced0ce43fa95176ea7599a854 (rc-8_14_0-1)Fixed by: https://github.com/curl/curl/commit/7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb (rc-8_22_0-3)OS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Mixed 4 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Affected | — |
| sid | Fixed | 8.22.0~rc3-1 |
| forky | Affected | — |
| bookworm | Fixed | 0 |
Alpine Fixed 2 releases
| Version | Status | Fixed in |
|---|---|---|
| v3.24 | Fixed | 8.22.0-r0 |
| v3.23 | Fixed | 8.22.0-r0 |
References
- https://www.suse.com/security/cve/CVE-2026-80229.html
- https://security-tracker.debian.org/tracker/CVE-2026-80229
- https://security.alpinelinux.org/vuln/CVE-2026-80229
- https://pkgs.alpinelinux.org/packages?name=curl
- https://curl.se/docs/CVE-2026-80229.html
- https://curl.se/docs/CVE-2026-80229.json
- https://hackerone.com/reports/3969255
CWEs
CWE-416
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.