CVE detail
CVE-2026-8925
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 4
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- CVE-2026-8925 SASL double-freeMicrosoft MSRC
Information published.
vendormsrc.microsoft.comJul 9, 2026, 8:49 AM - https://hackerone.com/reports/3735193hackerone.com
No excerpt available.
Exploithackerone.comJul 3, 2026, 7:16 AM No excerpt available.
Vendor Advisorycurl.seJul 3, 2026, 7:16 AMNo excerpt available.
Vendor Advisorycurl.seJul 3, 2026, 7:16 AM- Curl Fixes a 25-Year-Old Bug in Its Largest CVE Release YetSecurity Affairs
Curl fixed 18 vulnerabilities, including a 25-year-old bug, with issues spanning auth bypass, memory safety, and host validation in libcurl. Curl maintainers addressed eighteen vulnerabilities with a single update, and one of them goes back 25 years. That’s not a typo, it really sat there since the early 2000s. curl is a widely used open-source […]
newssecurityaffairs.comJun 25, 2026, 7:20 PM - 25-Year-Old Vulnerability Patched in CurlSecurityWeek
The latest version of the open source data transfer tool resolves 18 medium and low-severity vulnerabilities.
newswww.securityweek.comJun 25, 2026, 9:25 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2022-42915CVSS 8.1 · High
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNE…
- CVE-2019-5481CVSS 9.8 · Critical
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
- CVE-2016-8619CVSS 5.3 · Medium
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.
- CVE-2016-8618CVSS 5.3 · Medium
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `…
- CVE-2026-55995CVSS 8.7 · High
A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c053414…
- CVE-2026-17573CVSS 4.0 · Medium
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to a…