TLS Connection Handling Issues in libcurl Affecting OpenSSL Integrations

CVE-2026-80229

What is CVE-2026-80229?

libcurl's multi interface management in conjunction with OpenSSL 3 configurations has been found to allow pooled TLS connections to exceed their originating easy handles' lifecycle. This mismanagement results in the allocation of a library context that remains attached to active connections even after the easy handle is destroyed. Consequently, when I/O operations or post-handshake processes are executed, this flawed handling may evoke a heap-use-after-free vulnerability, potentially allowing attackers to exploit dangling pointers and cause memory corruption.

References