CVE-2026-80229
NONE—CVSS v3
—CVSS v2
0.22%
EPSS (exploit probability)
—CWE
Description
When performing transfers via libcurl’s multi interface, pooled TLS
connections can outlive their originating easy handles. In OpenSSL 3 provider
configurations, libcurl attaches an allocated library context to the easy
handle's state and passes it to OpenSSL without acquiring an ownership
reference; destroying the easy handle prematurely frees this context while the
active connection retains a dangling pointer, leading to a heap-use-after-free
upon subsequent I/O or post-handshake operations.
Affected routers (0)
No routers currently mapped to this CVE in our database.