CVE-2026-3805
use after free in SMB connection reuse
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
use after free in SMB connection reuse
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416, CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2026-11141
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
EUVD-2026-11141- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2289-hhfc-p684
When doing a second SMB request to the same host again, curl would wrongly use a data pointer...
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
GHSA-2289-hhfc-p684- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
ALPINE-CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2026-3805
- Record
BELL-CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 21 moreShow less
OSV
use after free in SMB connection reuse
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
DEBIAN-CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-439
When doing a second SMB request to the same host again, curl would wrongly use a data pointer...
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
JLSEC-2026-439- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:6893
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:6893- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2026-3805
CVE-2026-3805 in curl - Patched by Root
Root has patched CVE-2026-3805 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-320-CVE-2026-3805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2026-3805
CVE-2026-3805 in curl - Patched by Root
Root has patched CVE-2026-3805 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-321-CVE-2026-3805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2026-3805
CVE-2026-3805 in curl - Patched by Root
Root has patched CVE-2026-3805 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-322-CVE-2026-3805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-3805
CVE-2026-3805 in rootio-curl - Patched by Root
Root has patched CVE-2026-3805 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-3805- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-3805
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
UBUNTU-CVE-2026-3805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCURL-CVE-2026-3805 No score
use after free in SMB connection reuse
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
- Record
CURL-CVE-2026-3805- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10371-1 No score
curl-8.19.0-1.1 on GA media
These are all security issues fixed in the curl-8.19.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10371-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20404-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
openSUSE-SU-2026:20404-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0879-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:0879-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0885-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:0885-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0903-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:0903-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0911-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:0911-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20668-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:20668-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20722-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:20722-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20760-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:20760-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20918-1 No score
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
- Record
SUSE-SU-2026:20918-1- Updated
- 2026-11-02
OSVUSN-8084-1 No score
curl vulnerabilities
Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different connection, contrary to expectations. (CVE-2026-1965)
It was discovered that curl incorrectly leaked OAuth2 bearer tokens when following a redirect. This could result in tokens being sent to the wrong host, contrary to expectations. (CVE-2026-3783)
Muhamad Arga Reksapati discovered that curl incorrectly reused existing HTTP proxy connections even if the request used different credentials. This could result in the use of incorrect credentials, contrary to expectations. (CVE-2026-3784)
Daniel Wade discovered that curl incorrectly handled certain memory operations when doing a second SMB request to the same host. An attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 25.10. (CVE-2026-3805)
Yihang Zhou discovered that curl incorrectly reused .netrc file credentials when following redirects. This could result in the use of credentials for a different host, contrary to expectations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-0167)
- Record
USN-8084-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.21 |
8.13.0 up to 8.14.1-r3 | 8.14.1-r3 |
curlAlpine:v3.22 |
8.13.0 up to 8.14.1-r4 | 8.14.1-r4 |
curlAlpine:v3.23 |
8.13.0 up to 8.19.0-r0 | 8.19.0-r0 |
curlAlpine:v3.24 |
8.13.0 up to 8.19.0-r0 | 8.19.0-r0 |
curlAlpaquita:25 |
8.14.0-r1 up to 8.14.1-r4 | 8.14.1-r4 |
curlAlpaquita:stream |
8.13.0-r0 up to 8.19.0-r0 | 8.19.0-r0 |
curlBellSoft Hardened Containers:stream |
8.13.0-r0 up to 8.19.0-r0 | 8.19.0-r0 |
curlDebian:13 |
before 8.14.1-2+deb13u4, plus listed versions 8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3 |
8.14.1-2+deb13u4 |
curlDebian:14 |
before 8.19.0-1, plus listed versions 8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1 Show 31 moreShow less8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-1~bpo13+18.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-1 |
8.19.0-1 |
CURL_jllJulia |
8.13.0+0 up to 8.20.0+0 | 8.20.0+0 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
LibCURL_jllJulia |
8.13.0+0 up to 8.19.0+0 | 8.19.0+0 |
curlRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurlRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurl-develRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
libcurl-minimalRed Hat:hummingbird:1 From an advisory covering 13 CVEs |
before 0:8.19.0-3.hum1 | 0:8.19.0-3.hum1 |
curlRoot:Alpine:3.20 |
before 8.14.1-r20076 | 8.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712 |
rootio-curlRoot:Alpine:3.20 |
before 8.14.1-r20076 | 8.14.1-r200768.14.1-r200778.14.1-r200788.14.1-r200798.14.1-r2007108.14.1-r2007118.14.1-r200712 |
curlRoot:Alpine:3.21 |
before 8.14.1-r20073 | 8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r20077 |
rootio-curlRoot:Alpine:3.21 |
before 8.14.1-r20073 | 8.14.1-r200738.14.1-r200748.14.1-r200758.14.1-r200768.14.1-r20077 |
curlRoot:Alpine:3.22 |
before 8.14.1-r20072 | 8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079 |
rootio-curlRoot:Alpine:3.22 |
before 8.14.1-r20072 | 8.14.1-r200728.14.1-r200718.14.1-r200738.14.1-r200748.14.1-r300758.14.1-r300768.14.1-r300778.14.1-r300788.14.1-r30079 |
curlSUSE:Linux Enterprise Micro 5.2 From an advisory covering 4 CVEs |
before 8.14.1-150200.4.103.1 | 8.14.1-150200.4.103.1 |
curlSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 4 CVEs |
before 8.14.1-150600.4.40.1 | 8.14.1-150600.4.40.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 4 CVEs |
before 8.14.1-150600.4.40.1 | 8.14.1-150600.4.40.1 |
curlopenSUSE:Leap 15.6 From an advisory covering 4 CVEs |
before 8.14.1-150600.4.40.1 | 8.14.1-150600.4.40.1 |
curlSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 4 CVEs |
before 8.14.1-150700.7.14.1 | 8.14.1-150700.7.14.1 |
curlSUSE:Linux Enterprise Installer Updates 15 SP4 From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Installer Updates 15 SP5 From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Micro 5.3 From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Micro 5.4 From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Micro 5.5 From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 4 CVEs |
before 8.14.1-150400.5.80.1 | 8.14.1-150400.5.80.1 |
curlSUSE:Linux Micro 6.1 From an advisory covering 4 CVEs |
before 8.14.1-slfo.1.1_6.1 | 8.14.1-slfo.1.1_6.1 |
curlSUSE:Linux Micro 6.0 From an advisory covering 4 CVEs |
before 8.14.1-5.1 | 8.14.1-5.1 |
curlSUSE:Linux Micro 6.2 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
curlSUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
curl-miniSUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
curlSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
curl-miniSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
curlUbuntu:25.10 |
before 8.14.1-2ubuntu1.2, plus listed versions 8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.1 |
8.14.1-2ubuntu1.2 |
curlUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 7.81.0-1ubuntu1.23, plus listed versions 7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1 Show 18 moreShow less7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.207.81.0-1ubuntu1.217.81.0-1ubuntu1.22 |
7.81.0-1ubuntu1.23 |
curlUbuntu:24.04:LTS From an advisory covering 5 CVEs |
before 8.5.0-2ubuntu10.8, plus listed versions 8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu18.5.0-2ubuntu2 Show 10 moreShow less8.5.0-2ubuntu88.5.0-2ubuntu98.5.0-2ubuntu108.5.0-2ubuntu10.18.5.0-2ubuntu10.28.5.0-2ubuntu10.38.5.0-2ubuntu10.48.5.0-2ubuntu10.58.5.0-2ubuntu10.68.5.0-2ubuntu10.7 |
8.5.0-2ubuntu10.8 |
curlUbuntu:25.10 From an advisory covering 5 CVEs |
before 8.14.1-2ubuntu1.2, plus listed versions 8.12.1-3ubuntu18.13.0-5ubuntu18.14.1-1ubuntu28.14.1-1ubuntu38.14.1-2ubuntu18.14.1-2ubuntu1.1 |
8.14.1-2ubuntu1.2 |
curlopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.19.0-1.1 | 8.19.0-1.1 |
curlopenSUSE:Leap 16.0 From an advisory covering 4 CVEs |
before 8.14.1-160000.5.1 | 8.14.1-160000.5.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Rat5ak/CVE-2026-3805-curl-SMB-UAF | 2026-04-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3805 is a high vulnerability (CVSS 7.5) in Curl, published March 11, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in curl 8.14.1-r3.
References
curl.se/docs/CVE-2026-3805.json
hackerone.com/reports/3591944
openwall.com/lists/oss-security/2026/03/11/4
nvd.nist.gov/vuln/detail/CVE-2026-3805
github.com/advisories/GHSA-2289-hhfc-p684
Show 107 moreShow less
security.alpinelinux.org/vuln/CVE-2026-3805
docs.bell-sw.com/security/cves/CVE-2026-3805
security-tracker.debian.org/tracker/CVE-2026-3805
access.redhat.com/errata/RHSA-2026:6893
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json
bugzilla.redhat.com/show_bug.cgi?id=2394750
cve.org/CVERecord?id=CVE-2025-9086
suse.com/support/update/announcement/2026/suse-su-20260879-1
bugzilla.suse.com/1259362
ubuntu.com/security/CVE-2026-3805