p PatchFirst

ALPINE-CVE-2026-8925

ALPINE-CVE-2026-8925

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

CVSS 9.8 · Critical · Fix available

Published
Updated

Stack: system

Affected products and versions

  • curl Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: ≥ 8.15.0, < 8.22.0-r0

    Update to 8.22.0-r0

  • curl Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: ≥ 8.15.0, < 8.21.0-r0

    Update to 8.21.0-r0

Original sources

Check your server →