CVE-2026-9080
Low
UAF after pause in socket callback
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
Exploit probability
0.5%
Published
June 24, 2026
Required by
Not available
Last source change
June 24, 2026
02 / AFFECTED SOFTWARE
Affected packages
21 explicit affected versions
27 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2026-9080
View original source
Open Source Vulnerabilities
CURL-CVE-2026-9080
View original source
05 / REFERENCES