---
id: CVE-2026-80229
title: |-
  When performing transfers via libcurl’s multi interface, pooled TLS
  connections can outlive their originating easy handles
summary: |-
  When performing transfers via libcurl’s multi interface, pooled TLS
  connections can outlive their originating easy handles. In OpenSSL 3 provider
  configurations, libcurl attaches an allocated library context to the easy
  handle's state an…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-416
  - CWE-825
vendor: haxx
product: curl
affected:
  - 'curl >= 8.14.0, < 8.22.0'
patched:
  - curl 8.22.0
published: '2026-09-06'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:30.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80229'
references:
  - url: 'https://curl.se/docs/CVE-2026-80229.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-80229.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3969255'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80229.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80229'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2529206'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80229'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80229'
  - url: 'https://access.redhat.com/errata/RHSA-2026:63161'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T15:43:30.858480Z'
epss: 0.00563
epssPercentile: 0.46627
ingestedAt: '2026-09-07T10:08:54.617Z'
scores:
  nvd: 7.5
  vendor: 3.7
---

## Overview

When performing transfers via libcurl’s multi interface, pooled TLS
connections can outlive their originating easy handles. In OpenSSL 3 provider
configurations, libcurl attaches an allocated library context to the easy
handle's state and passes it to OpenSSL without acquiring an ownership
reference; destroying the easy handle prematurely frees this context while the
active connection retains a dangling pointer, leading to a heap-use-after-free
upon subsequent I/O or post-handshake operations.

## Affected

- `curl >= 8.14.0, < 8.22.0`

## Remediation

Upgrade past the affected range:

- `curl 8.22.0`

## Vendor advisories

- **RHSA-2026:63161** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63161)
- **Red Hat VEX** · Low · affected: Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80229.json)