TI-2026-03294 CVE-2026-3805 · GHSA-2289-hhfc-p684
use after free in SMB connection reuse
Priority HIGH 72
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
Vulnerabilities
4 records
TI-2026-03273 CVE-2026-3784 · GHSA-5q3w-6p3j-mw6p
wrong proxy connection reuse with credentials
Priority LOW 35
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy.
TI-2026-03272 CVE-2026-3783 · GHSA-8whr-249c-vfjp
token leak with redirect and netrc
Priority MEDIUM 63
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.
TI-2026-01624 CVE-2026-1965 · GHSA-q9qg-g2c3-3hr2
bad reuse of HTTP Negotiate connection
Priority LOW 29
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.