libcurl: use-after-free when a TLS 1.3 session ticket arrives on a reused connection

Impact

In curl 7.75.0 through 7.76.1 built against OpenSSL, libcurl stored a pointer to the transfer object for session-ticket callbacks. On a connection shared by multiple transfers (reused HTTP/1.1 or multiplexed HTTP/2), the first transfer can be freed before the session is established, so a ticket arriving later makes libcurl use freed memory and potentially call through a freed function pointer. A malicious server the client talks to can, in narrow circumstances, turn this into code execution in the client process. libcurl is the HTTP client underneath most node provisioning, image pulling, registry and telemetry paths, so the exposure is wherever fleet tooling fetches over TLS from a host an attacker influences. This is an old CVE and current distributions shipped fixes long ago; it is worth checking only on long-lived node images pinned to that curl range.

Who can reach it

Requires the client to connect to a server the attacker controls, over a connection carrying multiple transfers. No authentication. Not reachable by an attacker who cannot steer an outbound request.

What to do

Update curl/libcurl to 7.77.0 or the distribution's patched package and restart any long-running daemon that links libcurl (static binaries must be rebuilt). Rebuild node images pinned to the affected range; no reboot or firmware work is required.

References

Related entries

• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel NVMe target authentication (nvmet-auth DH group setup): CtrlCVE-2024-50215 · Linux kernel NVMe target authentication (nvmet-auth DH group setup)High
• OpenSSH (sshd): regreSSHion: signal-handler race in sshd giving unauthenticated remote root on glibc LinuxCVE-2024-6387 · OpenSSH (sshd)High
• Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry'sCVE-2025-40168 · Linux kernel (net/smc)High