Use after free in hyperfifo example

Disclosed: 2026-03-03 06:54:27 By deepbluev7 To curl
None
Vulnerability Details
## Summary: THIS ONLY IS AN ISSUE IN EXAMPLE CODE, NOT CURL ITSELF! In the hyperfifo example the event base is freed before the curl_multi_cleanup is called. This leads to a use after free in the addsocket callback, when libevent tries to lock a mutex in the base event during the curl shutdown. Link to the problematic code: https://github.com/curl/curl/blob/d6807890696019308bc885871575f3c2dac875d4/docs/examples/hiperfifo.c#L453 ## Affected version 8.18.0, but the bug has been there for a while, likely since the beginning of that example. Interestingly the multi-event example seems to not be affected. ## Steps To Reproduce: Running the example under ASAN should be sufficient. I have however not verified that, however the same code did cause crashes in my project: https://nheko.im/nheko-reborn/coeurl/-/commit/7e0afef3e774497efa29bf581630747cddd95e55 https://github.com/Nheko-Reborn/nheko/issues/1941 ## Impact ## Summary: ONLY AFFECTS AN EXAMPLE! NOT A BUG IN CURL! The impact should basically be none, I am only submitting this here, because I haven't found documentation on how issues in examples should be submitted and other projects might have copied the example as a base (like I did), which can lead to crashes in some circumstances. As such I am just being overly careful in reporting this, please close this as invalid or whatever, if you think that is the best approach. I just wanted to let you judge the impact of this instead of me just reporting something possibly sensitive on the bug tracker. I don't think an attacker could achieve much more that a crash in projects, that copied the example code. For example we were affected by this, but haven't filed any security issue about it either: https://github.com/Nheko-Reborn/nheko/issues/1941
Actions
View on HackerOne
Report Stats
  • Report ID: 3580247
  • State: Closed
  • Substate: informative
Share this report