Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2026-07-03

Status

Published

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

Weaknesses

CWE-415 Double Free

Coverage 1

vulnerability

25-Year-Old Vulnerability Patched in Curl

The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities. The post 25-Year-Old Vulnerability Patched in Curl appeared first on SecurityWeek .

SecurityWeek · Jun 25, 2026 High

CVE-2026-8932CVE-2026-8926CVE-2026-8925

All articles mentioning it

Advisories and references

• curl.se/docs/CVE-2026-8925.json
• curl.se/docs/CVE-2026-8925.html
• hackerone.com/reports/3735193