The cURL library contains a flaw in its SASL authentication handling where the GSASL context may be released twice without the pointer being cleared in between. This results in a double‑free (CWE‑415) that triggers memory corruption. When an application uses libcurl, the duplicated free can crash the process, causing a denial of service. No evidence indicates that the flaw provides data exposure or arbitrary code execution.

All builds of cURL that include SASL authentication functionality are affected. This includes both the standalone cURL command‑curl library used by third‑party applications. No specific version numbers are provided in the advisory, so any deployment containing the vulnerable SASL handling code should be assumed at risk.

The CVSS score of 9.8 categorizes this flaw as critical, while the EPSS score of < 1% indicates that exploitation is considered unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Attackers are inferred to exploit the double‑free by sending crafted SASL authentication requests to a cURL‑enabled service, prompting the library to free the same context twice and crash the process.