Updated information confirms that curl’s SASL authentication logic may free the GSASL context twice, resulting in a double‑free error (CWE‑1341). This memory corruption can cause the application using libcurl to crash, leading to denial of service. No information suggests that the flaw exposes data or permits arbitrary code execution.

All builds of cURL that include SASL authentication functionality are affected. This includes both the standalone cURL command‑line client and the libcurl library used by third‑party applications. No specific version numbers are provided in the advisory, so any deployment containing the vulnerable SASL handling code should be assumed at risk.

The CVSS score of 9.8 categorizes this flaw as critical, while the EPSS score of 1% indicates that exploitation is considered unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Attackers are inferred to exploit the double‑free by sending crafted SASL authentication requests to a cURL‑enabled service, prompting the library to free the same context twice and crash the process.