Search: CVE-2026-80229

CVE-2026-80229 is a vulnerability in libcurl's multi interface where pooled TLS connections can outlive their originating easy handles. In configurations using OpenSSL 3 providers, libcurl attaches a library context to the easy handle's state without proper ownership reference. Premature destruction of the easy handle frees this context while the active connection still holds a dangling pointer, causing a heap-use-after-free during subsequent I/O or post-handshake operations. This can lead to denial of service or arbitrary code execution. The issue affects specific Ubuntu package versions and has a CVSS score of 7.5 (medium severity). A fix is available via updated package versions provided by Ubuntu.