CVE-2026-8925
Published: July 1, 2026Last modified: July 6, 2026
Description
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | curl | Fixed (8.21.0-r0) |
| 25 LTS | curl | Unknown (8.14.0-r1) | |
| Stream | curl | Fixed (8.21.0-r0) | |
| Hardened Containers | Stream | curl | Fixed (8.21.0-r0) |