use of connection struct after free

{
  "id": "fb95c4ab55fb969a5fb05badf37c8118c85c8ab0df13bc31483ca17abdbb62d9",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2016-5421",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "use of connection struct after free",
    "summary": "libcurl is vulnerable to a use after free flaw. libcurl works with easy handles using the type 'CURL *' that are objects the application creates using `curl_easy_init()`. They are the handles that are all each associated with a single transfer at a time. libcurl also has an internal struct that represents and holds most state that is related to a single connection. An easy handle can hold references to one or many such connection structs depending on the requested operations. When using libcurl's multi interface, an application performs transfers by adding one or more easy handles to the multi handle and then it can drive all those transfers in parallel. Due to a flaw, libcurl could leave a pointer to a freed connection struct dangling in an easy handle that was previously added to a multi handle when `curl_multi_cleanup()` is called with an easy handle still added to it. This does not seem to cause any notable harm if the handle is then closed properly. However, if the easy handle would instead get used again with the easy interface and `curl_easy_perform()` to do another transfer, it would blindly use the connection struct pointer now pointing to freed memory. An application could be made to allocate its own fake version of the connect struct, fill in some data and then have the `curl_easy_perform()` call do something that clearly was not intended by the original code. For example, this could be an application using a component or library that uses libcurl to do something a",
    "evidence": "osv:CURL-CVE-2016-5421",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CURL-CVE-2016-5421",
      "aliases": [
        "CURL-CVE-2016-5421",
        "CVE-2016-5421"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.32.0"
                },
                {
                  "fixed": "7.50.1"
                }
              ]
            }
          ],
          "versions": [
            "7.50.0",
            "7.49.1",
            "7.49.0",
            "7.48.0",
            "7.47.1",
            "7.47.0",
            "7.46.0",
            "7.45.0",
            "7.44.0",
            "7.43.0",
            "7.42.1",
            "7.42.0",
            "7.41.0",
            "7.40.0",
            "7.39.0",
            "7.38.0",
            "7.37.1",
            "7.37.0",
            "7.36.0",
            "7.35.0",
            "7.34.0",
            "7.33.0",
            "7.32.0"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2016-5421.json"
          }
        }
      ],
      "modified": "2026-10-24T23:17:46Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-416",
          "desc": "Use After Free"
        },
        "URL": "https://curl.se/docs/CVE-2016-5421.json",
        "www": "https://curl.se/docs/CVE-2016-5421.html",
        "affects": "lib",
        "package": "curl",
        "severity": "High",
        "last_affected": "7.50.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2016-5421",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 444200,
  "published_at": "2016-08-03T08:00:00+00:00"
}