CVE-2026-9080: UAF after pause in socket callback

OtherCVSS 2.5€0

giant_anteater

Disclosed on HackerOne · June 24, 2026

12 min 3

Publicly disclosed report · by giant_anteater

Hi all,

We've found a heap-use-after-free in lib/multi_ev.c triggered by calling curl_easy_pause() from within a CURLMOPT_SOCKETFUNCTION callback. ASAN-confirmed with the self-contained reproducer below.

Affected versions: 8.13.0 – 8.20.0 (current).
The entry->action write (line 280) has been vulnerable since the multi_ev rewrite in 8.13.0 (commit cfc657a48d, 2025-04-02). The entry->announced bit-field write (line 275) was added in 8.16.0 (commit 3d302250ec,

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Sign In Register

LogicalBreach Academy

CVE-2026-9080: UAF after pause in socket callback

Identification Required

Discussion