Change #278688
| Category | None |
| Changed by | Viktor Szakats <commit@vsz.me> |
| Changed at | Sun 16 Aug 2026 23:26:40 |
| Repository | https://api.github.com/repos/curl/curl |
| Project | curl/curl |
| Branch | curl-8.20.X |
| Revision | 2ea0cbd27670d30c429763df7fbba6d0201c1ea0 |
Comments
CVE-2026-8925: SASL double-free gsasl: fix potential double free Also: - require libgsasl 1.6.0+ (2010-12-14) for a `gsasl_finish()` that handles a NULL argument. Ref: https://gitlab.com/gsasl/gsasl/-/commit/b550032df8488a9ceaa3cfd4c634947d8f219717 Reported-by: Joshua Rogers (Aisle Research) Closes #21609 Cherry-picked from 3da249e1f0716c0
Changed files
- docs/INTERNALS.md
- lib/vauth/gsasl.c