CVE-2026-8925: Haxx Curl Use-After-Free Vulnerability

CVE-2026-8925 Overview

CVE-2026-8925 is a double free vulnerability in the curl HTTP transfer library maintained by Haxx. The flaw resides in the Simple Authentication and Security Layer (SASL) logic, which handles authentication for protocols such as SMTP, IMAP, and POP3. The cleanup routine can invoke free() on the GSASL context pointer twice without clearing the pointer between calls. This memory corruption condition falls under [CWE-415] Double Free and affects haxx:curl across network-facing deployments.

Critical Impact
A network-reachable attacker can trigger memory corruption during SASL authentication, potentially leading to remote code execution, process crash, or heap manipulation without requiring privileges or user interaction.

Affected Products

Haxx curl (versions built with GSASL support)
Applications and services embedding vulnerable libcurl builds
Command-line curl clients performing SASL authentication over SMTP, IMAP, or POP3

Discovery Timeline

2026-07-03 - CVE-2026-8925 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-8925

Vulnerability Analysis

The defect exists in curl's SASL authentication cleanup path. When a session that uses GSASL as the authentication backend terminates, the teardown code releases the GSASL context memory. Under specific control flow conditions, that same context pointer reaches the cleanup routine a second time. Because the code does not reset the pointer to NULL after the first free(), the allocator receives the stale pointer again and processes it as valid.

Double free conditions corrupt heap metadata. Attackers who can influence subsequent allocations may steer the allocator into returning attacker-controlled memory locations. This creates a path from memory corruption to arbitrary write, and in many heap allocator implementations, to arbitrary code execution within the curl process.

The EPSS score of 1.08% places this issue in the 61st percentile of exploitation likelihood at publication.

Root Cause

The root cause is missing pointer sanitization after resource release. The SASL cleanup logic calls free() on the GSASL context handle but omits the assignment that would set the pointer to NULL. A second cleanup invocation, triggered by connection teardown paths that overlap with SASL state reset, then passes the freed pointer back to free().

Attack Vector

Exploitation requires a curl client to perform SASL authentication against an endpoint the attacker controls or can influence. A malicious mail server, or a network position that manipulates SASL negotiation flows, can drive curl into the code path that triggers the double free. No authentication or user interaction is required for the client to reach the vulnerable code. Automated batch mailers, CI/CD pipelines invoking curl for SMTP delivery, and applications using libcurl for IMAP or POP3 retrieval represent the highest-risk deployments.

Technical details are documented in the cURL CVE-2026-8925 Documentation and the HackerOne Report #3735193.

Detection Methods for CVE-2026-8925

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking against libcurl with GSASL support during or after SASL authentication
Heap corruption signatures in core dumps referencing Curl_sasl_cleanup or GSASL symbol frames
Outbound SMTP, IMAP, or POP3 connections from application hosts to unusual or untrusted mail infrastructure

Detection Strategies

Inventory all binaries linking against libcurl and identify builds compiled with GSASL support using curl -V or ldd against application processes
Monitor process telemetry for repeated crashes of services that use curl for SASL-authenticated mail protocols
Correlate network flows to mail servers with subsequent process termination events on the originating host

Monitoring Recommendations

Enable core dump collection on servers running curl-based automation and forward crash artifacts to a central analysis pipeline
Alert on SMTP, IMAP, and POP3 sessions terminating with abnormal TCP resets from client-side processes
Track version metadata for curl and libcurl across the fleet through software bill of materials (SBOM) tooling

How to Mitigate CVE-2026-8925

Immediate Actions Required

Upgrade curl and libcurl to the fixed release identified in the vendor advisory as soon as patched binaries are available for your platform
Audit application dependencies for statically linked libcurl builds that require rebuilding rather than package updates
Restrict outbound SMTP, IMAP, and POP3 connections from application hosts to an allowlist of trusted mail servers

Patch Information

Refer to the cURL CVE-2026-8925 Documentation for the authoritative list of affected and fixed versions. Machine-readable metadata is available in the cURL CVE-2026-8925 JSON Data. Distribution maintainers typically backport the fix into supported curl packages, so apply operating system updates once vendor advisories are published.

Workarounds

Rebuild curl without GSASL support if SASL authentication is not required for your workload
Disable SASL authentication in applications that can fall back to unauthenticated or TLS-only transport for mail protocols
Route mail traffic through a hardened relay so vulnerable clients do not authenticate directly against untrusted endpoints

bash

# Verify installed curl version and GSASL support
curl -V | grep -Ei 'curl|GSASL'

# Example: rebuild curl without GSASL where SASL is not required
./configure --without-gsasl
make && sudo make install