CVE-2015-3237: The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtai...

Security readout for executives and security teams

A malicious SMB server can make vulnerable cURL or libcurl clients read beyond intended memory. That may expose sensitive process memory or crash the client. Business urgency depends on whether affected versions are present and used to connect to SMB locations. Systems are exposed if they run cURL/libcurl 7.40.0 through 7.42.1 and use SMB support against untrusted or attacker-controlled SMB servers. Bundled copies in operating systems or vendor products should be checked through vendor advisories. Treat as targeted remediation, not an emergency, unless vulnerable clients contact untrusted SMB servers. The main business risks are sensitive memory disclosure and service disruption in legacy systems. Mitigation focus: Upgrade cURL/libcurl using vendor-supported packages or upstream guidance.; Prioritize systems that fetch from SMB locations or process untrusted URLs.; Check OS and appliance vendor advisories for bundled libcurl exposure..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.