CVE-2026-9080: UAF after pause in socket callback
Calling curleasypause() within the event-based CURLMOPTSOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.22.0-1Fixed in 8.23.0~rc1-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9080?
CVE-2026-9080 has a risk score of 21, indicating a high severity level due to potential exploitation.
How do I fix CVE-2026-9080?
To fix CVE-2026-9080, update to the latest version of libcurl that addresses this use-after-free vulnerability.
What is the nature of the vulnerability in CVE-2026-9080?
CVE-2026-9080 is a use-after-free vulnerability triggered by calling `curl_easy_pause()` in a specific callback.
Which software is affected by CVE-2026-9080?
CVE-2026-9080 affects the debian/curl software package.
When was CVE-2026-9080 published?
CVE-2026-9080 was published on July 3, 2026.