CVE-2026-80229

A flaw was found in libcurl when performing transfers via its multi interface with OpenSSL 3 provider configurations. Pooled TLS connections can outlive their originating easy handles, causing an allocated library context to be prematurely freed. This leaves the active connection with a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations. This memory corruption vulnerability could allow a remote attacker to cause a denial of service or potentially execute arbitrary code.

This flaw has a Low impact as it requires a specific configuration of libcurl using OpenSSL 3 providers with pooled TLS connections, and successful exploitation leads only to a low availability impact due to a heap-use-after-free. The high attack complexity further reduces the overall risk in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate developers should ensure pointers are set to NULL immediately after the memory they point to is freed. In production environments, administrators can mitigate this specific flaw by enabling the CURLOPT_FORBID_REUSE option for transfers using OpenSSL providers to prevent connection pooling from retaining dangling pointers.