SASL Authentication Vulnerability in Curl by cURL, Inc.
CVE-2026-8925

9.8CRITICAL

Key Information:

Vendor

Curl

Status
Curl
Vendor
CVE Published:
3 July 2026

What is CVE-2026-8925?

An issue within the Curl logic handling SASL authentication has been identified, where the GSASL context may be improperly managed. This flaw permits the context to be cleaned up multiple times without appropriately resetting the pointer, leading to a potential double free scenario. This could generate instability in applications relying on Curl when using SASL for authentication.

Affected Version(s)

curl 8.15.0 < 8.16.1

curl 8.17.0 < 8.20.1

curl ab650379a8c25ca952f651476d25b4cdd77bb3fc < 3da249e1f0716c06644ed3522a37a8bf81808012

References

https://curl.se/docs/CVE-2026-8925.json
https://curl.se/docs/CVE-2026-8925.html
https://hackerone.com/reports/3735193

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (Aisle Research)
Viktor Szakats
.