SASL Authentication Vulnerability in Curl by cURL, Inc.
CVE-2026-8925

9.8CRITICAL

Key Information:

Vendor

Curl

Status
Curl
Vendor
CVE Published:
3 July 2026

What is CVE-2026-8925?

An issue within the Curl logic handling SASL authentication has been identified, where the GSASL context may be improperly managed. This flaw permits the context to be cleaned up multiple times without appropriately resetting the pointer, leading to a potential double free scenario. This could generate instability in applications relying on Curl when using SASL for authentication.

Affected Version(s)

curl 8.20.0

curl 8.19.0

curl 8.18.0

References

https://curl.se/docs/CVE-2026-8925.json
https://curl.se/docs/CVE-2026-8925.html
https://hackerone.com/reports/3735193

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (Aisle Research)
Viktor Szakats
.