CVE-2026-3805: use after free in SMB connection reuse
Published Mar 11, 2026
·Updated
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
Affected Software
2 affected components
redhat/libcurl
haxx curl>=8.13.0<8.19.0
Remediation
Patch Available
Event History
Mar 11, 2026
CVE Published
via MITRE·10:09 AM
Data Sourced
via MITRE·10:09 AM
DescriptionWeakness
Data Sourced
via NVD·11:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 29, 58178
Event
via FIRST·02:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-3805?
CVE-2026-3805 has been classified as important due to its potential to cause application crashes and lead to unexpected behaviors.
2
How do I fix CVE-2026-3805?
To fix CVE-2026-3805, update to the latest version of libcurl that includes the necessary patches.
3
What is the impact of CVE-2026-3805?
The impact of CVE-2026-3805 includes potential data corruption and security vulnerabilities linked to improper memory management.
4
Which versions of libcurl are affected by CVE-2026-3805?
Libcurl versions prior to the fix for CVE-2026-3805 are affected; ensure you are using a patched version.
5
What applications utilize libcurl that may be at risk from CVE-2026-3805?
Any application using affected versions of libcurl for SMB connections may be at risk from CVE-2026-3805.