CVE-2026-3805: Use-After-Free in curl 8.13.0–8.18.0

The Use-After-Free vulnerability in curl allows an attacker to potentially trigger a denial-of-service (DoS) condition or, in more severe scenarios, achieve arbitrary code execution. By crafting malicious SMB requests, an attacker could manipulate curl's memory management, leading to crashes or the ability to overwrite critical data. Successful exploitation could allow an attacker to gain control of the system running curl, especially if curl is integrated into a larger application or service. The impact is amplified in environments where curl is used to interact with SMB servers, such as file transfer or network automation scripts.

1. Reserved2026-03-08
2. Published2026-03-11
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3805 is to upgrade to curl version 8.18.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting SMB connections to trusted hosts or implementing stricter input validation on SMB requests. WAF rules can be configured to filter out potentially malicious SMB request patterns. Monitor curl's memory usage for unusual spikes, which could indicate exploitation attempts. After upgrading, confirm the fix by sending a series of SMB requests to the same host and verifying that no crashes or memory errors occur.