CVE-2026-3805: Haxx Curl Use-After-Free Vulnerability

CVE-2026-3805 Overview

CVE-2026-3805 is a use-after-free vulnerability in curl, the widely deployed command-line tool and library for transferring data with URLs. The flaw resides in the Server Message Block (SMB) protocol handler. When a client issues a second SMB request to the same host, curl reuses a data pointer that references memory already freed during the prior request. The defect is tracked as CWE-416: Use After Free and was disclosed through the official curl security process.

Critical Impact
A remote SMB server or an attacker controlling SMB endpoints reached by curl can trigger memory corruption that leads to denial of service against the curl process.

Affected Products

Haxx curl (command-line tool)
libcurl (library) compiled with SMB protocol support
Applications and scripts that invoke curl against multiple SMB endpoints in a single session

Discovery Timeline

2026-03-11 - CVE-2026-3805 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3805

Vulnerability Analysis

The defect surfaces in the SMB protocol implementation inside libcurl. When curl performs an initial SMB transfer, it allocates and later frees per-connection state, including a buffer referenced by an internal data pointer. On a subsequent SMB request to the same host within the same handle, the SMB code path dereferences that stale pointer instead of reinitializing the structure. The resulting read or write touches deallocated heap memory.

The outcome is undefined behavior. In most observed conditions the process crashes, producing a denial of service. Under specific heap layouts an attacker may influence the content of the freed region, although no public exploit demonstrates code execution. The CVSS vector reflects an impact limited to availability.

Root Cause

The SMB handler fails to clear or refresh the cached data pointer between consecutive requests on a reused connection handle. The lifecycle of the freed buffer is not synchronized with the handle reuse logic, so the second request operates on a dangling pointer.

Attack Vector

Exploitation requires the victim to direct curl at an attacker-influenced SMB host and to make at least two requests against that host within the same session. The trigger is network-reachable and requires no authentication or user interaction beyond initiating the SMB transfers. See the curl.se advisory for CVE-2026-3805 and the corresponding HackerOne report #3591944 for protocol-level details.

No verified proof-of-concept code is published. The vulnerability mechanism is described in prose only; refer to the upstream advisory for the precise call sequence.

Detection Methods for CVE-2026-3805

Indicators of Compromise

Unexpected crashes, segmentation faults, or SIGSEGV exits of processes that wrap curl or link against libcurl when performing SMB transfers
Repeated outbound SMB connections (TCP/445 or TCP/139) from hosts running scripts that iterate over SMB URLs
Core dumps from curl-based jobs whose stack traces include SMB protocol functions in libcurl

Detection Strategies

Inventory hosts that ship curl or libcurl with SMB support enabled and correlate versions against the fixed release listed in the curl advisory
Hunt for command lines invoking curl smb:// or curl smbs:// URLs, especially loops or batch jobs that target the same host more than once
Review crash telemetry for libcurl-linked processes and tag stacks that include SMB request handling routines

Monitoring Recommendations

Alert on outbound SMB traffic from servers and developer endpoints that should not communicate over SMB to external destinations
Track package management events that install or upgrade curl across the fleet to confirm patched versions are deployed
Monitor automation pipelines and CI runners for unexpected process termination during SMB-based data transfers

How to Mitigate CVE-2026-3805

Immediate Actions Required

Upgrade curl and libcurl to the patched release identified in the official curl advisory for CVE-2026-3805
Audit scripts, applications, and container images for embedded curl binaries and rebuild or repackage them with the fixed version
Restrict outbound SMB egress at the network perimeter so curl clients cannot reach untrusted SMB servers

Patch Information

The curl maintainers issued a corrected SMB request handler that resets the affected data pointer between requests. Distribution maintainers are publishing backported packages; consult the curl.se JSON metadata for CVE-2026-3805 for the exact fixed version and commit hash and apply vendor updates through your standard package manager.

Workarounds

Disable SMB and SMBS protocol support when building libcurl by passing --disable-smb to configure, eliminating the vulnerable code path
Constrain runtime protocol use with CURLOPT_PROTOCOLS_STR or the --proto flag to exclude smb and smbs
Avoid reusing a single curl handle for multiple SMB requests to the same host until the patched build is deployed

bash

# Disable SMB at the curl command line
curl --proto -smb,-smbs https://example.invalid/

# Or rebuild libcurl without SMB support
./configure --disable-smb --disable-smbs
make && make install