What happened
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
Affected versions
curl: 8.21.0 through 8.21.0 (semver); 8.20.0 through 8.20.0 (semver); 8.19.0 through 8.19.0 (semver); 8.18.0 through 8.18.0 (semver); 8.17.0 through 8.17.0 (semver); 8.16.0 through 8.16.0 (semver); 8.15.0 through 8.15.0 (semver); 8.14.1 through 8.14.1 (semver); 8.14.0 through 8.14.0 (semver) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.