Description
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- curl / curlf2ce6c46b9dcc46ced0ce43fa95176ea7599a854 – 7ea37abc6ac0120ba5f6d94be8d196f7cf1506bb
- curl / curl8.20.0 – 8.20.0
- curl / curl8.19.0 – 8.19.0
- curl / curl8.18.0 – 8.18.0
- curl / curl8.17.0 – 8.17.0
- curl / curl8.16.0 – 8.16.0
- curl / curl8.15.0 – 8.15.0
- curl / curl8.14.1 – 8.14.1
- curl / curl8.14.0 – 8.14.0
- curl / curl8.21.0 – 8.21.0
- curl / curl8.14.0 – 8.14.2
- curl / curl8.15.0 – 8.16.1
- curl / curl8.17.0 – 8.20.1
- curl / curl8.21.0 – 8.22.0
- haxx / curl8.14.0 – 8.22.0
Updated 44m ago · 8 sources