CVE-2026-9080

HIGH 7.3

UAF after pause in socket callback

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

CWE	CWE-416
Vendor	curl
Product	curl
Published	Jul 3, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.13.0 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1

curl / curl

cfc657a48dbafb4194676d4c9d841388b3a22210 < 5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd

curl / curl

8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-9080.json curl.se: https://curl.se/docs/CVE-2026-9080.html hackerone.com: https://hackerone.com/reports/3749204

Credits

Joshua Rogers (Aisle Research) Joshua Rogers (Aisle Research) Daniel Stenberg