CVE-2026-8925

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8925", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-05-19T08:11:49.032Z", "datePublished": "2026-07-03T06:15:25.448Z", "dateUpdated": "2026-09-15T06:03:22.227Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:22.227Z"}, "title": "SASL double-free", "descriptions": [{"lang": "en", "value": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.1"}, {"version": "8.17.0", "status": "affected", "versionType": "semver", "lessThan": "8.20.1"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "ab650379a8c25ca952f651476d25b4cdd77bb3fc", "status": "affected", "versionType": "git", "lessThan": "3da249e1f0716c06644ed3522a37a8bf81808012"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.20.0", "status": "affected"}, {"version": "8.19.0", "status": "affected"}, {"version": "8.18.0", "status": "affected"}, {"version": "8.17.0", "status": "affected"}, {"version": "8.16.0", "status": "affected"}, {"version": "8.15.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-8925.json"}, {"url": "https://curl.se/docs/CVE-2026-8925.html"}, {"url": "https://hackerone.com/reports/3735193"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2026-8925", "aliases": ["CVE-2026-8925"], "summary": "SASL double-free", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "both", "URL": "https://curl.se/docs/CVE-2026-8925.json", "www": "https://curl.se/docs/CVE-2026-8925.html", "issue": "https://hackerone.com/reports/3735193", "CWE": {"id": "CWE-415", "desc": "Double Free"}, "last_affected": "8.20.0", "severity": "Medium"}, "published": "2026-06-24T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "ab650379a8c25ca952f651476d25b4cdd77bb3fc"}, {"fixed": "3da249e1f0716c06644ed3522a37a8bf81808012"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0"]}], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Viktor Szakats", "type": "remediation developer"}], "details": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Double Free", "cweId": "CWE-415", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Viktor Szakats", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://hackerone.com/reports/3735193", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T17:03:39.068747Z", "id": "CVE-2026-8925", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:04:15.411Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8925", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T17:03:39.068747Z"}}}], "references": [{"url": "https://hackerone.com/reports/3735193", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:04:11.447Z"}}], "cna": {"title": "SASL double-free", "x_osv": {"id": "CURL-CVE-2026-8925", "aliases": ["CVE-2026-8925"], "credits": [{"name": "Joshua Rogers (Aisle Research)", "type": "finder"}, {"name": "Viktor Szakats", "type": "remediation developer"}], "details": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "summary": "SASL double-free", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.15.0"}, {"fixed": "8.16.1"}, {"introduced": "8.17.0"}, {"fixed": "8.20.1"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "ab650379a8c25ca952f651476d25b4cdd77bb3fc"}, {"fixed": "3da249e1f0716c06644ed3522a37a8bf81808012"}]}], "versions": ["8.20.0", "8.19.0", "8.18.0", "8.17.0", "8.16.0", "8.15.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2026-06-24T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-415", "desc": "Double Free"}, "URL": "https://curl.se/docs/CVE-2026-8925.json", "www": "https://curl.se/docs/CVE-2026-8925.html", "issue": "https://hackerone.com/reports/3735193", "affects": "both", "package": "curl", "severity": "Medium", "last_affected": "8.20.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Viktor Szakats"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.15.0", "lessThan": "8.16.1", "versionType": "semver"}, {"status": "affected", "version": "8.17.0", "lessThan": "8.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "ab650379a8c25ca952f651476d25b4cdd77bb3fc", "lessThan": "3da249e1f0716c06644ed3522a37a8bf81808012", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-8925.json"}, {"url": "https://curl.se/docs/CVE-2026-8925.html"}, {"url": "https://hackerone.com/reports/3735193"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "Double Free"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:03:22.227Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8925", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:03:22.227Z", "dateReserved": "2026-05-19T08:11:49.032Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-07-03T06:15:25.448Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.16.1", "status": "affected", "version": "8.15.0", "versionType": "semver"}, {"lessThan": "8.20.1", "status": "affected", "version": "8.17.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "3da249e1f0716c06644ed3522a37a8bf81808012", "status": "affected", "version": "ab650379a8c25ca952f651476d25b4cdd77bb3fc", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.20.0"}, {"status": "affected", "version": "8.19.0"}, {"status": "affected", "version": "8.18.0"}, {"status": "affected", "version": "8.17.0"}, {"status": "affected", "version": "8.16.0"}, {"status": "affected", "version": "8.15.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "F370F8A5-9F2D-4B51-A575-A2F8C7E28E38", "versionEndExcluding": "8.21.0", "versionStartIncluding": "8.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."}], "id": "CVE-2026-8925", "lastModified": "2026-09-15T07:16:32.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8925", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T17:03:39.068747Z", "version": "2.0.3"}}]}, "published": "2026-07-03T07:16:24.950", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-8925.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2026-8925.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3735193"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3735193"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "curl: curl: Double-free vulnerability in SASL authentication", "id": "2496762", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496762"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "A flaw was found in curl. The logic handling SASL (Simple Authentication and Security Layer) authentication could lead to a double-free vulnerability. This occurs because the GSASL context may be deallocated twice without clearing the pointer, potentially leading to memory corruption. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-8925", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Affected", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2026-07-03T06:15:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-8925\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8925\nhttps://curl.se/docs/CVE-2026-8925.html\nhttps://curl.se/docs/CVE-2026-8925.json\nhttps://hackerone.com/reports/3735193"], "statement": "This Important flaw in curl's SASL authentication logic could lead to a double-free vulnerability, potentially resulting in memory corruption, denial of service, or arbitrary code execution. The impact is significant as curl is a widely used utility in Red Hat environments, and SASL authentication is a common enterprise configuration. Exploitation requires an attacker to interact with a service utilizing the vulnerable SASL authentication within curl. Exploitation of this flaw requires controlling which memory is addressed in the second free call and this is unlikely to be possible.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.20.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.19.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.18.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.17.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.16.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.15.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "curl", "source": "cna", "vendor": "curl"}, "product": "curl", "vendor": "curl"}], "created": "2026-07-03T07:45:03.410359+00:00", "updated": "2026-08-13T12:30:10.774375+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}