CVE-2026-8925: curl Double Free
CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2026-8925UBUNTU-CVE-2026-8925DEBIAN-CVE-2026-8925CGA-2p2x-hf7f-mf7qCGA-2wxp-m9vm-49w5CGA-39q9-2r7h-cwmqCGA-3wjf-wq48-6hxvCGA-4hv7-9rq3-wfghCGA-5743-4473-g939CGA-67xv-h4h7-wq55CGA-8hr3-qjx2-vpg3CGA-8m95-65rq-h75rCGA-8wwm-gxq3-834hCGA-fr65-357c-j686CGA-fvcw-vxq9-cm3gCGA-h2hf-4p9h-vqp5CGA-hcmm-23rc-rjcqCGA-mpv9-c3hf-ww2wCGA-v6xq-j4mr-q9j4CGA-vr4x-h5mr-8435CGA-vxmq-jhpf-89v7CGA-xm6v-q83x-w687CGA-xqff-j3jf-crh6
Published 03-07-2026Last modified 15-09-2026
Vulnerability summary
CVE-2026-8925 is a critical (CVSS 9.8) Double Free vulnerability in curl. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
1.08%
0%100%
Low · +0.41 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 03-07-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.41 pp
From 0.67% on 21-09-2026
21-09-202621-10-2026
EPSS score1.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- eco-python-curl< 8.21.0-r0
- eco-python-curl-minimal< 8.21.0-r0
- eco-python-curl-minimal-bin< 8.21.0-r0
- eco-python-curl-minimal-dev< 8.21.0-r0
- eco-python-curl-minimal-doc< 8.21.0-r0
Alpine1 product
- curl≥ 8.15.0, < 8.22.0-r0 | ≥ 8.15.0, < 8.21.0-r0
Curl1 product
- curl≥ 8.15.0, < 8.16.1 | ≥ 8.17.0, < 8.20.1 | ≥ ab650379a8c25ca952f651476d25b4cdd77bb3fc, < 3da249e1f0716c06644ed3522a37a8bf81808012 | 8.20.0 | 8.19.0 | 8.18.0 | 8.17.0 | 8.16.0 | 8.15.0
Debian1 product
- curl< 8.21.0~rc2-1
Haxx1 product
- curl≥ 8.15.0, < 8.21.0
Ubuntu1 product
- curl< 7.81.0-1ubuntu1.25 | < 8.5.0-2ubuntu10.10 | < 8.14.1-2ubuntu1.4 | < 8.18.0-1ubuntu2.2
6 vendors · 15 products
