CVE-2026-5773 Details
Description
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.
A vulnerability exists in libcurl versions 7.40.0 through 8.19.0, where the library may incorrectly reuse SMB connections for transfers. This issue arises because libcurl maintains a pool of recent connections to reduce overhead, but a logical error allows a transfer to reuse a connection that is linked to a different 'share' on the same server. As a result, this flaw could lead to downloading the wrong file or uploading a file to an incorrect location, all while using the same credentials and server name.
Users are advised to upgrade to curl and libcurl version 8.20.0, where this vulnerability has been fixed. Alternatively, the patch can be applied manually and libcurl rebuilt.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3650689 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-5773.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-5773.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3650689 | curl | ExploitIssue TrackingThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/29/9 | CVE | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
| CWE-488 | Exposure of Data Element to Wrong Session | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.40.0, < 8.20.0 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CVE |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | curl |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CVE |
| May 13, 2026 | New CVE Received | curl |