CVE-2026-80229 OpenSSL provider use-after-free
A use-after-free in libcurl's multi interface with OpenSSL 3 allows attackers to execute code or cause denial of service via dangling pointers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80229?
CVE-2026-80229 is a high-severity use after free vulnerability in Haxx Curl, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
Weakness: CWE-416
Which versions are affected by CVE-2026-80229?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-80229?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-80229 being exploited?
There is no known exploitation of CVE-2026-80229 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-80229, AZL-99795, AZL-99837, AZL-99867, BELL-CVE-2026-80229, CURL-CVE-2026-80229 and 10 more.