What changed
curl 8.22.0 shipped on September 2 2026, coordinated with the publication of the CVE-2026-80229 advisory 1. In OpenSSL 3 provider configurations, libcurl attached an allocated library context to the easy handle without acquiring an ownership reference, so destroying that handle prematurely freed the context while the live connection kept a dangling pointer, and later I/O hit a heap-use-after-free 1. The advisory classifies it as CWE-416: Use After Free at Severity: low, with affected versions curl 8.14.0 to and including 8.21.0 1. Stanislav Fort of Aisle Research reported it on August 24 2026 12.
The version window runs backwards
Read the range before you read the severity. The not-affected versions are curl < 8.14.0 and >= 8.22.0 1, so the exposed fleet is the one that kept moving across the 8.14 to 8.21 line, while a service still pinned below 8.14.0 never had the bug. That inverts the triage reflex, which sends you after the stalest binary first. I would run the inventory the other way this week: list what tracks curl closely and links OpenSSL 3, since providers exist only in libcurl built to use OpenSSL 3+ 1, then check whether anything there can destroy an easy handle while a pooled connection is still live.
Low severity measures how narrow the configuration is. The failure inside it is a heap-use-after-free 1. In my experience that caveat mostly means nobody has enumerated who is in it.
The advisory asks for one of three actions immediately, in order of preference: upgrade curl and libcurl to 8.22.0, apply the patch and rebuild, or enable CURLOPT_FORBID_REUSE for transfers using providers 1.
/* Recommendation C, scoped to transfers using providers */
curl_easy_setopt(easy, CURLOPT_FORBID_REUSE, 1L);
Impact on your team
The decision this week is not whether to upgrade, it is who owns the rebuild. libcurl is a vendored dependency far more often than a package you installed, so the version that matters is the one baked into your images and your language bindings, far from the build host. Aisle Research says six of its 29 reports to the curl project became CVEs in 8.22.0, all rated low severity 2; a patch process triggered by high-severity findings skips the whole batch. Pick the components that link OpenSSL 3, get 8.22.0 into them, and keep CURLOPT_FORBID_REUSE out of the permanent configuration.