CVE-2026-9080: Haxx Curl Use-After-Free Vulnerability

CVE-2026-9080 Overview

CVE-2026-9080 is a use-after-free vulnerability [CWE-416] in libcurl, the widely deployed HTTP client library maintained by the curl project. Calling curl_easy_pause() from within the event-based CURLMOPT_SOCKETFUNCTION callback causes libcurl to write a flag through a dangling struct pointer. The pointer's backing memory has already been released at the moment of the write. Applications using libcurl's multi interface with socket callbacks are exposed. Successful exploitation can corrupt heap state, leak process memory, or crash the calling process.

Critical Impact
Heap corruption in libcurl can affect any network-facing application that links the library, potentially undermining confidentiality, integrity, and availability of the process.

Affected Products

Haxx curl / libcurl (as identified by CPE cpe:2.3:a:haxx:curl:*)
Applications embedding libcurl and using CURLMOPT_SOCKETFUNCTION
Software calling curl_easy_pause() from inside the socket callback

Discovery Timeline

2026-07-03 - CVE-2026-9080 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-9080

Vulnerability Analysis

The defect lives in libcurl's event-driven multi interface. When an application registers CURLMOPT_SOCKETFUNCTION, libcurl invokes that callback to signal socket activity changes. If the callback re-enters libcurl through curl_easy_pause(), the pause path attempts to store a flag on a per-transfer struct. That struct has already been freed on the current code path, leaving a dangling pointer. The subsequent write occurs on freed memory, producing classic use-after-free behavior.

Because the vulnerable operation is a targeted write into a released allocation, an attacker who can influence heap layout and the timing of pause invocations may steer the write into an attacker-controlled allocation. In hardened builds this typically manifests as a crash, but on standard allocators it can enable memory disclosure or control-flow influence depending on downstream reuse of the freed region.

Root Cause

The root cause is a lifetime mismatch between the transfer object and the socket callback re-entry path. libcurl frees the struct before the pause code writes back into it, and no state check guards that path.

Attack Vector

The attack vector is network-adjacent: a remote peer able to influence transfer state transitions can drive the callback sequence needed to reach the freed struct. Local attackers controlling the application's URL, headers, or connection reuse can also trigger the condition. No authentication or user interaction is required for the vulnerable code path.

No public exploit is currently available. See the cURL CVE-2026-9080 Advisory and HackerOne Report #3749204 for technical details.

Detection Methods for CVE-2026-9080

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking libcurl during multi-interface transfers
Heap corruption diagnostics from AddressSanitizer or glibc malloc (double free or corruption, free(): invalid pointer) tied to curl_easy_pause
Abnormal termination of long-lived services (proxies, package managers, telemetry agents) that use CURLMOPT_SOCKETFUNCTION

Detection Strategies

Inventory binaries linking libcurl.so and identify those using the multi socket interface
Run application test suites under ASan or Valgrind to surface the use-after-free write on the pause path
Correlate application crash telemetry with the presence of vulnerable libcurl versions per the vendor advisory

Monitoring Recommendations

Alert on repeated crash signatures referencing Curl_easy_pause or curl_multi_socket_action in core dumps
Track libcurl versions across the fleet via SBOM tooling and flag versions listed in the cURL CVE-2026-9080 JSON
Monitor outbound HTTP transfer failures that coincide with process restarts on hosts running affected software

How to Mitigate CVE-2026-9080

Immediate Actions Required

Upgrade libcurl to the fixed release identified in the cURL CVE-2026-9080 Advisory
Rebuild and redistribute statically linked applications that bundle a vulnerable libcurl
Audit application code for curl_easy_pause() calls issued from inside CURLMOPT_SOCKETFUNCTION

Patch Information

The curl project has published advisory and machine-readable metadata at cURL CVE-2026-9080 Advisory and cURL CVE-2026-9080 JSON. Apply the fixed libcurl version referenced in those resources across all endpoints, servers, containers, and appliances that embed the library.

Workarounds

Refactor application code to defer curl_easy_pause() calls out of the socket callback, for example by scheduling the pause on the main event loop
Avoid the event-based multi socket interface where feasible and use curl_multi_perform until the patched version is deployed
Restrict which remote endpoints the application will contact to reduce exposure to attacker-influenced transfer state

bash

# Verify installed libcurl version and upgrade
curl --version
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libcurl4
# RHEL/Alma/Rocky
sudo dnf upgrade libcurl