CVE-2026-3805

🗓️ 11 Mar 2026 10:09:37Reported by curlType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 21 Views🌐 WEB

CVE-2026-3805: use after free in SMB connection reuse causes pointer to freed memory on second SMB request by curl.

Reporter	Title	Published	Views	Family All 71
FreeBSD	curl -- Multiple vulnerabilties	11 Mar 202600:00	–	freebsd
GithubExploit	Exploit for Use After Free in Haxx Curl	12 Apr 202611:12	–	githubexploit
ATTACKERKB	CVE-2026-3805	11 Mar 202610:09	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-1699)	16 May 202600:00	–	nessus
Tenable Nessus	Curl 8.13.0 < 8.19.0 Use After Free in SMB Connection	17 Mar 202600:00	–	nessus
Tenable Nessus	Fedora 43 : curl (2026-66db242036)	20 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 42 : curl (2026-907bbf2a13)	19 Apr 202600:00	–	nessus
Tenable Nessus	Fedora 44 : curl (2026-f13d888b0f)	27 Apr 202600:00	–	nessus
Tenable Nessus	FreeBSD : curl -- Multiple vulnerabilties (1933737d-1d46-11f1-81da-8447094a420f)	11 Mar 202600:00	–	nessus
Tenable Nessus	Photon OS 5.0: Curl PHSA-2026-5.0-0785	17 Mar 202600:00	–	nessus

NVD

Node

haxx curlRange8.13.0–8.19.0

[
  {
    "vendor": "curl",
    "product": "curl",
    "versions": [
      {
        "version": "8.18.0",
        "status": "affected",
        "lessThanOrEqual": "8.18.0",
        "versionType": "semver"
      },
      {
        "version": "8.17.0",
        "status": "affected",
        "lessThanOrEqual": "8.17.0",
        "versionType": "semver"
      },
      {
        "version": "8.16.0",
        "status": "affected",
        "lessThanOrEqual": "8.16.0",
        "versionType": "semver"
      },
      {
        "version": "8.15.0",
        "status": "affected",
        "lessThanOrEqual": "8.15.0",
        "versionType": "semver"
      },
      {
        "version": "8.14.1",
        "status": "affected",
        "lessThanOrEqual": "8.14.1",
        "versionType": "semver"
      },
      {
        "version": "8.14.0",
        "status": "affected",
        "lessThanOrEqual": "8.14.0",
        "versionType": "semver"
      },
      {
        "version": "8.13.0",
        "status": "affected",
        "lessThanOrEqual": "8.13.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
curl	www.curl.se/docs/CVE-2026-3805.html
curl	www.curl.se/docs/CVE-2026-3805.json
hackerone	www.hackerone.com/reports/3591944
openwall	www.openwall.com/lists/oss-security/2026/03/11/4

Parameter	Position	Path	Description	CWE
path	path	smb://192.168.1.100/share1/file1.txt	Use-after-free in SMB path handling when reusing a connection leads to a dangling req->path pointing inside freed memory	CWE-416
path	path	smb://192.168.1.100/share2/file2.txt	Use-after-free in SMB path handling when reusing a connection leads to a dangling req->path pointing inside freed memory	CWE-416

12 Mar 2026 14:08Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.0003

SSVC

CWE-416