Change #278691

Comments

CVE-2026-9080: UAF after pause in socket callback

Cherry-picked a6af50c484f6b - which is not the fix that is mentioned in
the CVE, but was merged later.

multi: forbid curl_easy_pause from within multi socket callback

- there is a risk for a nasty recursive situation

- we avoid certain risks that the pause call changes things so that when
  returning from the callback, the state of some internals is undefined
  and we need to reload which is easy to miss

- we can't think of legitiate use cases for doing this. This is
  basically just the new favorite point for AI and security researchers
  to find hypothetical problems

Closes #22179

Changed files

• docs/libcurl/curl_easy_pause.md
• lib/easy.c
• lib/multi.c
• lib/multi_ev.c
• lib/multihandle.h
• lib/multiif.h
• tests/libtest/lib758.c