OpenSSL provider use-after-free
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-80229
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:10 UTC · Revision 1
Source evidence
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
osv:CURL-CVE-2026-80229
Complete source record
{
"id": "804f46038236f6fc60b28ac2e064cbe47d2e967099c9a95650d0736b8c73bb2a",
"url": "https://osv.dev/vulnerability/CURL-CVE-2026-80229",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenSSL provider use-after-free",
"summary": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.",
"evidence": "osv:CURL-CVE-2026-80229",
"products": [],
"severity": "low",
"structured": {
"id": "CURL-CVE-2026-80229",
"aliases": [
"CURL-CVE-2026-80229",
"CVE-2026-80229"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.14.0"
},
{
"fixed": "8.14.2"
},
{
"introduced": "8.15.0"
},
{
"fixed": "8.16.1"
},
{
"introduced": "8.17.0"
},
{
"fixed": "8.20.1"
},
{
"introduced": "8.21.0"
},
{
"fixed": "8.22.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "f2ce6c46b9dcc46ced0ce43fa95176ea7599a854"
},
{
"fixed": "7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb"
}
]
}
],
"versions": [
"8.21.0",
"8.20.0",
"8.19.0",
"8.18.0",
"8.17.0",
"8.16.0",
"8.15.0",
"8.14.1",
"8.14.0",
"rc-8_22_0-2",
"rc-8_22_0-1",
"curl-8_21_0",
"rc-8_21_0-3",
"rc-8_21_0-2",
"rc-8_21_0-1",
"curl-8_20_0",
"rc-8_20_0-3",
"rc-8_20_0-2",
"rc-8_20_0-1",
"curl-8_19_0",
"rc-8_19_0-3",
"rc-8_19_0-2",
"rc-8_19_0-1",
"curl-8_18_0",
"rc-8_18_0-3",
"rc-8_18_0-2",
"rc-8_18_0-1",
"curl-8_17_0",
"curl-8_16_0",
"curl-8_15_0",
"curl-8_14_1",
"curl-8_14_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2026-80229.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2026-80229-49021c9f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286481243370392075526062118659509114348",
"196216237767420629426097604457509099271",
"68125101134514249852390309734181512406",
"31227070220736528463295638619520929314"
]
},
"source": "https://github.com/curl/curl.git/commit/7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb",
"target": {
"file": "lib/vtls/openssl.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2026-80229-74875d56",
"digest": {
"length": 4945,
"function_hash": "93812128733312520413839406253910216274"
},
"source": "https://github.com/curl/curl.git/commit/7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb",
"target": {
"file": "lib/vtls/openssl.c",
"function": "Curl_ossl_ctx_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-26T13:07:43Z"
}
}
],
"modified": "2026-10-26T13:07:43.340610703Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-416",
"desc": "Use After Free"
},
"URL": "https://curl.se/docs/CVE-2026-80229.json",
"www": "https://curl.se/docs/CVE-2026-80229.html",
"issue": "https://hackerone.com/reports/3969255",
"affects": "both",
"package": "curl",
"severity": "Low",
"last_affected": "8.21.0"
}
},
"related_cves": [
{
"value": "CVE-2026-80229",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 453270,
"published_at": "2026-09-02T08:00:00+00:00"
}