Skip to main content

Curl CVE-2026-3805

HIGH
Use After Free (CWE-416)
2026-03-11 2499f714-1537-4658-8207-48ae4bb9eae9
Use After Free Curl Red Hat Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
6.3 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
PoC Detected
Mar 12, 2026 - 14:08 vuln.today
Public exploit code
Patch released
Mar 12, 2026 - 14:08 nvd
Patch available
CVE Published
Mar 11, 2026 - 11:16 nvd
HIGH 7.5

DescriptionCVE.org

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

AnalysisAI

Curl's SMB implementation contains a use-after-free vulnerability that causes denial of service when processing consecutive requests to the same host, as the library incorrectly dereferences freed memory on subsequent connections. Public exploit code exists for this vulnerability affecting Curl installations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send initial SMB request to curl
Exploit
Send second SMB request to same host
Execution
Curl reuses freed memory pointer
Impact
Denial of service via crash
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions — remote unauthenticated exploitation against curl with SMB protocol support enabled connecting to any SMB server. Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 7.5 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker could exploit this vulnerability to compromise the affected system.
Remediation A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems running affected curl versions and assess SMB usage in production environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.25 Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.26 Container suse/sle-micro/base-5.5:2.0.4-5.8.252 Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Affected
Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Affected
Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest Container suse/manager/5.0/x86_64/server-migration-14-16:latest Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.140 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.107 Container suse/sl-micro/6.0/toolbox:13.2-9.77 Image SL-Micro Affected

Share

CVE-2026-3805 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy