Zero Day MonitorZDM

← Back to list

—

CVE-2026-9080EXPLOITED

curl · curl

UAF after pause in socket callback

Description

A vulnerability was found in curl libcURL up to 8.20.0. It has been rated as critical. The impacted element is the function curl_easy_pause. This manipulation causes use after free. This vulnerability is registered as CVE-2026-9080. Remote exploitation of the attack is possible.

Affected Products

Vendor	Product	Versions
curl	curl	8.20.0, 8.19.0, 8.18.0, 8.17.0, 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0

References

Related News (2 articles)

Tier A

Microsoft MSRC3h ago

CVE-2026-9080 UAF after pause in socket callback

→ No new info (linked only)

Tier C

VulDB4d ago

CVE-2026-9080 | curl libcURL up to 8.20.0 curl_easy_pause use after free

→ No new info (linked only)

CISA KEV❌ No

Actively exploited✅ Yes

PublishedJul 3, 2026

Last enriched4d agov2

Trending Score60

Source articles2

Independent2

Info Completeness6/14

Missing: cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-8926EXP

password leak with netrc and user in URL

CRITICALCVE-2026-10536

HTTP/2 stream-dependency tree UAF

CRITICALCVE-2026-8924

trailing dot domain super cookie

HIGHCVE-2026-8286

wrong STARTTLS connection reuse

HIGHCVE-2026-9545

exposing HTTP/3 early data

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 3, 2026

Actively Exploited

Jul 3, 2026

Discovered by ZDM

Jul 3, 2026

Updated: severity, activelyExploited, description

Jul 3, 2026

Version History

v2

Last enriched 4d ago

v2Tier C4d ago

Updated severity to CRITICAL, marked as actively exploited, and provided a more detailed description of the vulnerability.

severityactivelyExploiteddescription

via VulDB

v14d ago

Initial creation