All vulnerabilities

Servers and applications

CVE-2018-16840

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

Severity
Critical 9.8
Published
31 Oct 2018
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.62.0
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • From 7.59.0 before 7.62.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-16840
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-16840