CVE-2026-5773
published 2026-05-13CVE-2026-5773: libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.02%
5.9th percentile
libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a network transfer operation that was requested by an
application could wrongfully reuse an existing SMB connection to the same
server that was using a different 'share' than the new subsequent transfer
should.
This could in unlucky situations lead to the download of the wrong file or the
upload of a file to the wrong place. When this happens, the same credentials
are used and the server name is the same.
Affected
121 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| build-of-trustee | trustee-rhel9 | — | — |
| confidential-compute-attestation-tech-preview | trustee-rhel9 | — | — |
| confidential-containers | trustee | — | — |
| curl | curl | 7.40.0 – 7.40.0 | — |
| curl | curl | 7.41.0 – 7.41.0 | — |
| curl | curl | 7.42.0 – 7.42.0 | — |
| curl | curl | 7.42.1 – 7.42.1 | — |
| curl | curl | 7.43.0 – 7.43.0 | — |
| curl | curl | 7.44.0 – 7.44.0 | — |
| curl | curl | 7.45.0 – 7.45.0 | — |
| curl | curl | 7.46.0 – 7.46.0 | — |
| curl | curl | 7.47.0 – 7.47.0 | — |
| curl | curl | 7.47.1 – 7.47.1 | — |
| curl | curl | 7.48.0 – 7.48.0 | — |
| curl | curl | 7.49.0 – 7.49.0 | — |
| curl | curl | 7.49.1 – 7.49.1 | — |
| curl | curl | 7.50.0 – 7.50.0 | — |
| curl | curl | 7.50.1 – 7.50.1 | — |
| curl | curl | 7.50.2 – 7.50.2 | — |
| curl | curl | 7.50.3 – 7.50.3 | — |
| curl | curl | 7.51.0 – 7.51.0 | — |
| curl | curl | 7.52.0 – 7.52.0 | — |
| curl | curl | 7.52.1 – 7.52.1 | — |
| curl | curl | 7.53.0 – 7.53.0 | — |
| curl | curl | 7.53.1 – 7.53.1 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-05-04
CVE-2026-4873 curl vulnerabilities
Title: curl vulnerabilities
Summary: curl could be made to expose sensitive information over the network.
It was discovered that curl incorrectly reused non-TLS connections when
TLS was required in some STARTTLS configurations. A remote attacker could
possibly use this issue to obtain sensitive information. (CVE-2026-4873)
It was discovered that curl incorrectly reused certain HTTP Negotiate
connections. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-5545)
It was discovered that curl incorrectly reused certain SMB connections. A
remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2026-5773)
It was discovered that curl could leak proxy credentials when handling
redirects in some configurations. A remote attacke
Red Hat
curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse
vendor_redhat·2026-04-29·CVSS 6.5
CVE-2026-5773 [MEDIUM] CWE-1025 curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse
curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse
A flaw was found in libcurl. Due to a logical error in the connection reuse mechanism for SMB (Server Message Block) transfers, libcurl might reuse an existing SMB connection with a different share than intended. This vulnerability, categorized as CWE-488 (Exposure of Data Element to Wrong Session), could lead to the download of an incorrect file or the upload of a file to an unintended location when an application uses libcurl for SMB transfers.
Statement: This Moderate impact flaw in libcurl affects applications performing SMB transfers. A logical error in the SMB connection reuse mechanism can lead to unintended file downloads or uploads to incorrect locations. This impacts applications that rely on libcurl for s
GHSA
GHSA-rp9q-8q5w-ch44: libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers
ghsa_unreviewed·2026-05-13
CVE-2026-5773 [HIGH] CWE-918 GHSA-rp9q-8q5w-ch44: libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers
libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a network transfer operation that was requested by an
application could wrongfully reuse an existing SMB connection to the same
server that was using a different 'share' than the new subsequent transfer
should.
This could in unlucky situations lead to the download of the wrong file or the
upload of a file to the wrong place. When this happens, the same credentials
are used and the server name is the same.
No detection rules found.
No public exploits indexed.
2026-05-13
Published