CVE-2026-9080: curl Use After Free
CVSS: 7.3v3.1HighModified
AliasesALPINE-CVE-2026-9080UBUNTU-CVE-2026-9080DEBIAN-CVE-2026-9080CGA-42fw-4gmf-mv72CGA-65hq-mqv8-cmqvCGA-66vh-x9c4-6hp8CGA-69p5-49rv-8p4xCGA-72mw-w659-q95gCGA-7642-xgfx-cg23CGA-7x5m-2xjh-m6pxCGA-83mq-77p8-8c22CGA-85x8-rvhw-8r28CGA-8r2v-qj73-gmr9CGA-c534-r7pf-wqjqCGA-f2h9-h2mr-8r72CGA-ghph-v7q2-g4r2CGA-hfgg-cpjr-8xf8CGA-hwjv-552c-3v34CGA-mh9r-fjqr-q6q8CGA-mv2h-66wh-rv47CGA-qvjr-xmpp-54hmCGA-rpq5-5jcw-m2mgCGA-x28j-7vcr-gqh3
Published 03-07-2026Last modified 15-09-2026
Vulnerability summary
CVE-2026-9080 is a high (CVSS 7.3) Use After Free vulnerability in curl. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.3/10
010
High · v3.1 (CVE.org)EPSS score
0.49%
0%100%
Low · +0.20 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 12 · Related 12Timeline
- 03-07-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.20 pp
From 0.29% on 21-09-2026
21-09-202621-10-2026
EPSS score0.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- eco-python-curl< 8.21.0-r0
- eco-python-curl-minimal< 8.21.0-r0
- eco-python-curl-minimal-bin< 8.21.0-r0
- eco-python-curl-minimal-dev< 8.21.0-r0
- eco-python-curl-minimal-doc< 8.21.0-r0
Alpine1 product
- curl≥ 8.13.0, < 8.22.0-r0 | ≥ 8.13.0, < 8.21.0-r0
Curl1 product
- curl≥ 8.13.0, < 8.14.2 | ≥ 8.15.0, < 8.16.1 | ≥ 8.17.0, < 8.20.1 | ≥ cfc657a48dbafb4194676d4c9d841388b3a22210, < 5ab34cba42e4ee4282fe8bab43f311d51b9bf9bd | 8.20.0 | 8.19.0 | 8.18.0 | 8.17.0 | 8.16.0 | 8.15.0 | 8.14.1 | 8.14.0 | 8.13.0
Debian1 product
- curlAll versions (No fix recorded) | < 8.21.0~rc2-1
Haxx1 product
- curl≥ 8.13.0, < 8.21.0
Ubuntu1 product
- curl< 8.14.1-2ubuntu1.4 | < 8.20.0-2ubuntu11 | < 8.18.0-1ubuntu2.2
6 vendors · 15 products
