Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-3805 EUVD-2026-11141GHSA-2289-hhfc-p684

use after free in SMB connection reuse

Published Mar 11, 2026 · Updated Sep 15, 2026 · Assigned by curl

Vendor: curl Product: curl Package: curl Package: curl Package: curl Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

When doing a second SMB request to the same host again, curl would wrongly use
a data pointer pointing into already freed memory.

Affected products

VendorProductAffectedFixed
curl curl 8.13.0 – < 8.14.2, 8.15.0 – < 8.16.1, 8.17.0 – < 8.19.0, 8.18.0, 8.17.0, 8.16.0, 8.15.0, 8.14.1, 8.14.0, 8.13.0 8.14.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 curl 8.19.0-1 —
Debian 13 curl 8.14.1-2+deb13u4 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 curl 8.14.1-2ubuntu1.2 USN-8084-1
Ubuntu 24.04 LTS curl 8.5.0-2ubuntu10.8 USN-8084-1
Ubuntu 22.04 LTS curl 7.81.0-1ubuntu1.23 USN-8084-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 curl +3 8.19.0-3.hum1 RHSA-2026:6893

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 curl 8.14.1-150700.7.14.1 SUSE-SU-2026:0903-1
SLES 15 SP6 curl 8.14.1-150600.4.40.1 SUSE-SU-2026:0885-1
SLES 15 SP5 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SLES 15 SP4 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 curl +1 8.14.1-160000.5.1 SUSE-SU-2026:20918-1
SLES for SAP 15 SP6 curl 8.14.1-150600.4.40.1 SUSE-SU-2026:0885-1
SLES 16.0 curl +1 8.14.1-160000.5.1 SUSE-SU-2026:20918-1
SLE Micro 6.2 curl 8.14.1-160000.5.1 SUSE-SU-2026:20760-1
SLE Micro 6.1 curl 8.14.1-slfo.1.1_6.1 SUSE-SU-2026:20668-1
SLE Micro 6.0 curl 8.14.1-5.1 SUSE-SU-2026:20722-1
SLE Micro 5.5 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SLE Micro 5.4 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SLE Micro 5.3 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SLE Micro 5.2 curl 8.14.1-150200.4.103.1 SUSE-SU-2026:0879-1
SLE HPC 15 SP5 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SLE HPC 15 SP4 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SUSE Linux Enterprise Installer Updates 15 SP5 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1
SUSE Linux Enterprise Installer Updates 15 SP4 curl 8.14.1-150400.5.80.1 SUSE-SU-2026:0911-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed curl 8.19.0-1.1 openSUSE-SU-2026:10371-1
openSUSE Leap 16.0 curl 8.14.1-160000.5.1 openSUSE-SU-2026:20404-1
openSUSE Leap 15.6 curl 8.14.1-150600.4.40.1 SUSE-SU-2026:0885-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 curl 8.19.0-r0 —
Alpine v3.23 curl 8.19.0-r0 —
Alpine v3.22 curl 8.14.1-r4 —
Alpine v3.21 curl 8.14.1-r3 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 curl +4 8.17.0-1.amzn2023.0.3 ALAS2023-2026-1699

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 14

References