CVE-2026-8925: SASL double-free
Published Jul 3, 2026
·Updated
Last updated 2 July 2026
Other sources
The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice.
— MITRE
Affected Software
2 affected componentsFixes available
debian/curl<=8.20.0-5
7.74.0-1.3+deb11u137.74.0-1.3+deb11u167.88.1-10+deb12u147.88.1-10+deb12u58.14.1-2+deb13u38.21.0-2
haxx curl>=8.15.0<8.21.0
Remediation
Patch Available
Event History
Jul 1, 2026
Data Sourced
via Debian·03:07 AM
DescriptionAffected Software
Jul 3, 2026
Data Sourced
via Ubuntu·03:08 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·06:15 AM
Data Sourced
via MITRE·06:15 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 11, 58531
Event
via FIRST·10:05 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-8925?
CVE-2026-8925 has a risk level of 21.
2
What causes CVE-2026-8925?
CVE-2026-8925 is caused by the curl logic that incorrectly cleans up the GSASL context twice.
3
How do I fix CVE-2026-8925?
To fix CVE-2026-8925, you should upgrade to the latest version of curl that contains the patch for this vulnerability.
4
Which software is affected by CVE-2026-8925?
CVE-2026-8925 affects the Debian version of curl.
5
What type of vulnerability is CVE-2026-8925?
CVE-2026-8925 is classified as a double free vulnerability.