CVE-2018-16840 — curl: Use-after-free when closing "easy" handle in Curl_close()

Back Back to CVE browser

CRITICAL

curl: Use-after-free when closing "easy" handle in Curl_close()

Published Oct 31, 2018

9.8

CRITICAL

CVSS 3.1

EPSS 3.40%

Description

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

Affected products

Vendor The Curl Project Product Curl Default
n/a
- Version
  from 7.59.0 to 7.61.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

The Curl Project

Curl

n/a

Version	Status	Constraints
from 7.59.0 to 7.61.1	affected	-

JBoss Core Services Apache HTTP Server 2.4.29 SP2

n/a

Fixed · RHSA-2019:1543
.NET Core 1.0 on Red Hat Enterprise Linux

rh-dotnetcore10-curl

Not affected
.NET Core 1.1 on Red Hat Enterprise Linux

rh-dotnetcore11-curl

Not affected
.NET Core 2.1 on Red Hat Enterprise Linux

rh-dotnet21-curl

Not affected
Red Hat Enterprise Linux 5

curl

Not affected
Red Hat Enterprise Linux 6

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Linux 8

curl

Not affected
Red Hat JBoss Core Services

jbcs-httpd24-curl

Affected
Red Hat JBoss Web Server 5

curl

Not affected
Red Hat Software Collections

httpd24-curl

Fix deferred

Product	Package	State	Advisory
JBoss Core Services Apache HTTP Server 2.4.29 SP2	n/a	Fixed	RHSA-2019:1543
.NET Core 1.0 on Red Hat Enterprise Linux	rh-dotnetcore10-curl	Not affected	n/a
.NET Core 1.1 on Red Hat Enterprise Linux	rh-dotnetcore11-curl	Not affected	n/a
.NET Core 2.1 on Red Hat Enterprise Linux	rh-dotnet21-curl	Not affected	n/a
Red Hat Enterprise Linux 5	curl	Not affected	n/a
Red Hat Enterprise Linux 6	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Linux 8	curl	Not affected	n/a
Red Hat JBoss Core Services	jbcs-httpd24-curl	Affected	n/a
Red Hat JBoss Web Server 5	curl	Not affected	n/a
Red Hat Software Collections	httpd24-curl	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

3.40% 0.03398

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03398

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.40% (0.03398)	88.44th	v5 (v2026.06.15)
Jun 15, 2026	3.33% (0.03333)	87.01th	v5 (v2026.06.15)
Mar 17, 2025	0.38% (0.00379)	57.32th	v4 (v2025.03.14)
Jul 20, 2024	1.17% (0.01174)	85.16th	v3 (v2023.03.01)
Jun 19, 2024	1.17% (0.01174)	85.05th	v3 (v2023.03.01)
May 2, 2024	1.66% (0.01656)	87.45th	v3 (v2023.03.01)
Mar 23, 2024	1.54% (0.01543)	86.85th	v3 (v2023.03.01)
Nov 29, 2023	1.39% (0.01392)	84.88th	v3 (v2023.03.01)
Oct 25, 2023	1.38% (0.01381)	84.86th	v3 (v2023.03.01)
Jul 8, 2023	1.12% (0.01118)	82.61th	v3 (v2023.03.01)
Mar 29, 2023	0.79% (0.00794)	79.01th	v3 (v2023.03.01)
Mar 7, 2023	0.83% (0.00834)	79.42th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Sep 17, 2022	1.11% (0.01108)	53.57th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)
Feb 3, 2022	1.45% (0.01454)	32.67th	v1
Jan 6, 2022	1.45% (0.01454)	31.96th	v1
Sep 1, 2021	1.45% (0.01454)	71.88th	v1
Apr 14, 2021	1.45% (0.01454)	0.00th	v1

Weaknesses (1)

CWE-416

Use After Free

References (10)

http://www.securitytracker.com/id/1042013
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-16840
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1642203
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840
x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://curl.haxx.se/docs/CVE-2018-16840.html
x_refsource_MISCPatchVendor Advisory
https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-16840
https://security.gentoo.org/glsa/201903-03
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://usn.ubuntu.com/3805-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-16840

Link	Providers	Tags
http://www.securitytracker.com/id/1042013		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-16840		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1642203		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://curl.haxx.se/docs/CVE-2018-16840.html		x_refsource_MISCPatchVendor Advisory
https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f		x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-16840
https://security.gentoo.org/glsa/201903-03		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://usn.ubuntu.com/3805-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-16840

Change history (4)

Sep 22, 2026, 11:19 AM UTC MITRE
- CVSS vector changed from CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L to CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS score changed from 5 to 4.3
Sep 22, 2026, 09:53 AM UTC REDHAT
- CVSS vector changed from CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N to CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- CVSS score changed from 4.3 to 5