{"advisories":[{"id":"USN-8084-1","source":"usn","title":"curl vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8084-1"}],"cve":"CVE-2026-3805","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.18.0,8.18.0]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.17.0,8.17.0]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.16.0,8.16.0]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.15.0,8.15.0]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.14.1,8.14.1]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.14.0,8.14.0]"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.13.0,8.13.0]"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"curl","source":"cna","vendor":"curl"},"product":"curl","vendor":"curl"}],"analysis":{"en":{"generated_at":"2026-03-17T16:34:45.869739+00:00","value":{"mitigation_remediation":["Upgrade your curl installation to the latest stable release that contains the CVE‑2026‑3805 fix.","If an upgrade is not immediately possible, consult the curl project website, support forums, or advisories for a patch or advisory on work‑arounds.","Until a patched version is available, avoid reusing SMB connections in curl programs; use a fresh handle or close the connection after each SMB operation."],"summary":{"action":"Patch Immediately","impact":"Remote Code Execution"},"threat_synthesis":{"affected_systems":"The affected product is curl, listed under the haxx vendor (cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*). No specific version range is provided in the data, so any instance of curl that performs an SMB connection reuse could be susceptible. System administrators should consider all installations that use curl for SMB operations vulnerable until a patch is applied.","description_and_impact":"The vulnerability is a classic use‑after‑free condition in the curl library. According to the vendor description, during a second SMB request to the same host, curl incorrectly reuses a data pointer that references memory that has already been freed, leading to a use‑after‑free (CWE‑416). This memory corruption can allow an attacker to influence program behavior, potentially resulting in arbitrary code execution or denial of service by corrupting critical data structures.","risk_and_exploitability":"The CVSS score is 7.5, indicating a high severity, while the EPSS score is below 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to get a vulnerable curl instance to perform a second SMB request to the same host; the attack vector is remote, as the flaw occurs entirely within the client library during SMB communication."}}}},"created":"2026-03-12T10:06:02.941012+00:00","updated":"2026-03-20T14:37:23.802678+00:00","vendors":["curl","curl$PRODUCT$curl"]},"epss":{"score":0.00896},"mitre":{"cpes":[],"created":"2026-03-11T10:09:37.729000+00:00","description":"When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/3xxx/CVE-2026-3805.json","references":["https://curl.se/docs/CVE-2026-3805.html","https://curl.se/docs/CVE-2026-3805.json","https://hackerone.com/reports/3591944"],"title":"use after free in SMB connection reuse","updated":"2026-09-15T06:02:55.871000+00:00","vendors":[],"weaknesses":["CWE-416"]},"nvd":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"created":"2026-03-11T11:16:00.967000+00:00","description":"When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-3805.json","references":["http://www.openwall.com/lists/oss-security/2026/03/11/4","https://curl.se/docs/CVE-2026-3805.html","https://curl.se/docs/CVE-2026-3805.json","https://hackerone.com/reports/3591944"],"title":null,"updated":"2026-09-14T21:17:06.383000+00:00","vendors":["haxx","haxx$PRODUCT$curl"],"weaknesses":["CWE-416"]},"opencve":{"changes":[{"created":"2026-03-11T10:30:00+00:00","data":[{"details":{"new":"When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.","old":null},"type":"description"},{"details":{"new":"use after free in SMB connection reuse","old":null},"type":"title"},{"details":{"added":["https://curl.se/docs/CVE-2026-3805.html","https://curl.se/docs/CVE-2026-3805.json","https://hackerone.com/reports/3591944"],"removed":[]},"type":"references"}],"id":"63f83a1a-89eb-49a9-9b62-dd31c3ef7d74"},{"created":"2026-03-11T11:30:00+00:00","data":[{"details":{"added":["http://www.openwall.com/lists/oss-security/2026/03/11/4"],"removed":[]},"type":"references"}],"id":"e4a8223b-336a-460b-909e-e8561afb0d6c"},{"created":"2026-03-11T16:15:00+00:00","data":[{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"fbd8948b-9f48-40a2-90ee-2aa422452fbd"},{"created":"2026-03-12T10:15:00+00:00","data":[{"details":["curl","curl$PRODUCT$curl"],"type":"first_time"},{"details":{"added":["curl","curl$PRODUCT$curl"],"removed":[]},"type":"vendors"}],"id":"166c532d-a7e4-45b3-a05c-9a416cd53591"},{"created":"2026-03-12T14:15:00+00:00","data":[{"details":["haxx","haxx$PRODUCT$curl"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["haxx","haxx$PRODUCT$curl"],"removed":[]},"type":"vendors"}],"id":"e9fbd1a3-7d50-4ef5-a622-67cb7df7c7aa"},{"created":"2026-03-13T00:15:00+00:00","data":[{"details":{"added":["CWE-825"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-3805","https://www.cve.org/CVERecord?id=CVE-2026-3805"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"d5a3c169-a5f7-47af-926a-2cc34eeb64cf"}],"cpes":{"data":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-03-11T10:09:37+00:00","provider":"redhat"},"description":{"data":"When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00896},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["http://www.openwall.com/lists/oss-security/2026/03/11/4","https://curl.se/docs/CVE-2026-3805.html","https://curl.se/docs/CVE-2026-3805.json","https://hackerone.com/reports/3591944","https://nvd.nist.gov/vuln/detail/CVE-2026-3805","https://www.cve.org/CVERecord?id=CVE-2026-3805"],"providers":["mitre","nvd","redhat"]},"title":{"data":"use after free in SMB connection reuse","provider":"mitre"},"updated":{"data":"2026-03-20T14:37:23.802678+00:00","provider":"enrichment"},"vendors":{"data":["curl","curl$PRODUCT$curl","haxx","haxx$PRODUCT$curl"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-416","CWE-825"],"providers":["mitre","nvd","redhat","vulnrichment"]}},"redhat":{"cpes":[],"created":"2026-03-11T10:09:37+00:00","description":"A flaw was found in curl. When handling a second Server Message Block (SMB) request to the same host, curl incorrectly accesses memory that has already been freed. This memory corruption vulnerability, known as a use-after-free, could allow a remote attacker to potentially execute arbitrary code or cause a denial of service.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-3805.json","references":["http://www.openwall.com/lists/oss-security/2026/03/11/4","https://curl.se/docs/CVE-2026-3805.html","https://curl.se/docs/CVE-2026-3805.json","https://hackerone.com/reports/3591944","https://nvd.nist.gov/vuln/detail/CVE-2026-3805","https://www.cve.org/CVERecord?id=CVE-2026-3805"],"title":"curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling","updated":"2026-03-11T10:09:37+00:00","vendors":[],"weaknesses":["CWE-825"]},"vulnrichment":{"cpes":[],"created":"2026-03-11T10:09:37.729000+00:00","description":"When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"use after free in SMB connection reuse","updated":"2026-03-11T15:45:22.292000+00:00","vendors":[],"vulnrichment_repo_path":"2026/3xxx/CVE-2026-3805.json","weaknesses":["CWE-416"]}}