CVE-2026-9080
ADVISORY - debianSummary
Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
- curl 8.21.0~rc2-1 [trixie] - curl (Minor issue) [bookworm] - curl (Vulnerable code not present) [bullseye] - curl (Vulnerable code not present) https://curl.se/docs/CVE-2026-9080.html Introduced with: https://github.com/curl/curl/commit/cfc657a48dbafb4194676d4c9d841388b3a22210 (curl-8_13_0) Fixed by: https://github.com/curl/curl/commit/5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd (rc-8_21_0-1, curl-8_21_0)
EPSS Score: 0.00295 (0.222)
Common Weakness Enumeration (CWE)
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-9080
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.23 | <=8.19.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.24 | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.20 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | edge | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.23 | <=8.17.0-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.20.0-r0 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-9080
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowUbuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-9080
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowChainguard
CREATED
UPDATED
ADVISORY ID
CGA-56qv-r6xj-fjqc
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-9080
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
7.3highminimos
CREATED
UPDATED
ADVISORY ID
MINI-w52c-qj93-h79j
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-x957-h4jq-22wh
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-