CVE-2026-80229

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description A heap-use-after-free occurs when using libcurl's multi interface with OpenSSL 3 provider configurations. The issue arises because libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference. If the easy handle is destroyed prematurely, the context is freed while the active connection retains a dangling pointer, which can be triggered during subsequent I/O or post-handshake operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.