CVE-2026-3805 use after free in SMB connection reuse
A use-after-free flaw in curl's SMB connection reuse allows attackers to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3805?
CVE-2026-3805 is a high-severity use after free vulnerability in Haxx Curl, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
Weakness: CWE-416
Which versions are affected by CVE-2026-3805?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-3805?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-3805 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3805 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-3805, BELL-CVE-2026-3805, CURL-CVE-2026-3805, DEBIAN-CVE-2026-3805, ECHO-4deb-219d-e7eb, GHSA-2289-hhfc-p684 and 6 more.