CVE-2026-3805 Details
Description
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
A use-after-free vulnerability has been identified in curl and libcurl versions 8.13.0 through 8.18.0, specifically within the SMB protocol handling. The issue arises when a second SMB request is made to the same host. Curl improperly uses a data pointer that references already freed memory, which can lead to undefined behavior. Although this vulnerability has the potential to cause a crash or other noticeable issues, it is considered difficult for an attacker to exploit intentionally. However, there is a slight risk of leaking sensitive information if the freed memory is reallocated with attacker-controlled data before being read.
Users can upgrade to curl and libcurl version 8.19.0, where this vulnerability has been fixed. Alternatively, the patch can be applied to the libcurl version in use and then rebuild the library.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://curl.se/docs/CVE-2026-3805.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-3805.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3591944 | curl | ExploitIssue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/11/4 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 8.13.0, < 8.19.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | curl |
| Sep 14, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | curl |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | New CVE Received | curl |
| Mar 11, 2026 | CVE Modified | CVE |