CVE-2026-8925

CRITICAL 9.8

SASL double-free

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

CWE	CWE-415
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new critical vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.15.0 < 8.16.1 8.17.0 < 8.20.1

curl / curl

ab650379a8c25ca952f651476d25b4cdd77bb3fc < 3da249e1f0716c06644ed3522a37a8bf81808012

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-8925.json curl.se: https://curl.se/docs/CVE-2026-8925.html hackerone.com: https://hackerone.com/reports/3735193

Credits

Joshua Rogers (Aisle Research) Viktor Szakats