Vulnerability-Lookup

FKIE_CVE-2026-5773

Vulnerability from fkie_nvd - Published: 2026-05-13 13:01 - Updated: 2026-09-15 07:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

References

URL	Tags
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-5773.html	Patch, Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2026-5773.json	Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/3650689	Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/04/29/9	Mailing List, Patch, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://hackerone.com/reports/3650689	Exploit, Issue Tracking, Third Party Advisory

Impacted products

	Vendor	Product	Version
	haxx	curl	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "74a169575d6412dc0ff532acdf94de35a6c2a571",
              "status": "affected",
              "version": "aec2e865f06669b9cb5d26cc1148d70bc418b163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            }
          ]
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACA618E8-E657-401D-8884-FE82245671E2",
              "versionEndExcluding": "8.20.0",
              "versionStartIncluding": "7.40.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."
    }
  ],
  "id": "CVE-2026-5773",
  "lastModified": "2026-09-15T07:16:28.820",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-5773",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-13T17:45:00.901945Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-13T13:01:56.307",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2026-5773.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://curl.se/docs/CVE-2026-5773.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/3650689"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/3650689"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ],
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2026-5773 (GCVE-0-2026-5773)

Vulnerability from cvelistv5 – Published: 2026-05-13 08:27 – Updated: 2026-09-15 06:03

Title

wrong reuse of SMB connection

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 17:45 UTC

CWE

CWE-488 - Exposure of Data Element to Wrong Session

Assigner

curl redhat root

References

4 references

URL	Tags
https://curl.se/docs/CVE-2026-5773.json
https://curl.se/docs/CVE-2026-5773.html
https://hackerone.com/reports/3650689
http://www.openwall.com/lists/oss-security/2026/04/29/9

Impacted products

3 products

Vendor	Product	Version
curl	curl	Affected: 7.40.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.1 (semver) Affected: 8.17.0 , < 8.20.0 (semver)
curl	curl	Affected: aec2e865f06669b9cb5d26cc1148d70bc418b163 , < 74a169575d6412dc0ff532acdf94de35a6c2a571 (git)
curl	curl	Affected: 8.19.0 Affected: 8.18.0 Affected: 8.17.0 Affected: 8.16.0 Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0 Affected: 8.12.1 Affected: 8.12.0 Affected: 8.11.1 Affected: 8.11.0 Affected: 8.10.1 Affected: 8.10.0 Affected: 8.9.1 Affected: 8.9.0 Affected: 8.8.0 Affected: 8.7.1 Affected: 8.7.0 Affected: 8.6.0 Affected: 8.5.0 Affected: 8.4.0 Affected: 8.3.0 Affected: 8.2.1 Affected: 8.2.0 Affected: 8.1.2 Affected: 8.1.1 Affected: 8.1.0 Affected: 8.0.1 Affected: 8.0.0 Affected: 7.88.1 Affected: 7.88.0 Affected: 7.87.0 Affected: 7.86.0 Affected: 7.85.0 Affected: 7.84.0 Affected: 7.83.1 Affected: 7.83.0 Affected: 7.82.0 Affected: 7.81.0 Affected: 7.80.0 Affected: 7.79.1 Affected: 7.79.0 Affected: 7.78.0 Affected: 7.77.0 Affected: 7.76.1 Affected: 7.76.0 Affected: 7.75.0 Affected: 7.74.0 Affected: 7.73.0 Affected: 7.72.0 Affected: 7.71.1 Affected: 7.71.0 Affected: 7.70.0 Affected: 7.69.1 Affected: 7.69.0 Affected: 7.68.0 Affected: 7.67.0 Affected: 7.66.0 Affected: 7.65.3 Affected: 7.65.2 Affected: 7.65.1 Affected: 7.65.0 Affected: 7.64.1 Affected: 7.64.0 Affected: 7.63.0 Affected: 7.62.0 Affected: 7.61.1 Affected: 7.61.0 Affected: 7.60.0 Affected: 7.59.0 Affected: 7.58.0 Affected: 7.57.0 Affected: 7.56.1 Affected: 7.56.0 Affected: 7.55.1 Affected: 7.55.0 Affected: 7.54.1 Affected: 7.54.0 Affected: 7.53.1 Affected: 7.53.0 Affected: 7.52.1 Affected: 7.52.0 Affected: 7.51.0 Affected: 7.50.3 Affected: 7.50.2 Affected: 7.50.1 Affected: 7.50.0 Affected: 7.49.1 Affected: 7.49.0 Affected: 7.48.0 Affected: 7.47.1 Affected: 7.47.0 Affected: 7.46.0 Affected: 7.45.0 Affected: 7.44.0 Affected: 7.43.0 Affected: 7.42.1 Affected: 7.42.0 Affected: 7.41.0 Affected: 7.40.0

Credits

Osama Hamad Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-13T09:05:23.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-5773",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T17:45:00.901945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T17:45:08.173Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3650689"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.1",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.20.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "74a169575d6412dc0ff532acdf94de35a6c2a571",
              "status": "affected",
              "version": "aec2e865f06669b9cb5d26cc1148d70bc418b163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.19.0"
            },
            {
              "status": "affected",
              "version": "8.18.0"
            },
            {
              "status": "affected",
              "version": "8.17.0"
            },
            {
              "status": "affected",
              "version": "8.16.0"
            },
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            },
            {
              "status": "affected",
              "version": "8.12.1"
            },
            {
              "status": "affected",
              "version": "8.12.0"
            },
            {
              "status": "affected",
              "version": "8.11.1"
            },
            {
              "status": "affected",
              "version": "8.11.0"
            },
            {
              "status": "affected",
              "version": "8.10.1"
            },
            {
              "status": "affected",
              "version": "8.10.0"
            },
            {
              "status": "affected",
              "version": "8.9.1"
            },
            {
              "status": "affected",
              "version": "8.9.0"
            },
            {
              "status": "affected",
              "version": "8.8.0"
            },
            {
              "status": "affected",
              "version": "8.7.1"
            },
            {
              "status": "affected",
              "version": "8.7.0"
            },
            {
              "status": "affected",
              "version": "8.6.0"
            },
            {
              "status": "affected",
              "version": "8.5.0"
            },
            {
              "status": "affected",
              "version": "8.4.0"
            },
            {
              "status": "affected",
              "version": "8.3.0"
            },
            {
              "status": "affected",
              "version": "8.2.1"
            },
            {
              "status": "affected",
              "version": "8.2.0"
            },
            {
              "status": "affected",
              "version": "8.1.2"
            },
            {
              "status": "affected",
              "version": "8.1.1"
            },
            {
              "status": "affected",
              "version": "8.1.0"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "7.88.1"
            },
            {
              "status": "affected",
              "version": "7.88.0"
            },
            {
              "status": "affected",
              "version": "7.87.0"
            },
            {
              "status": "affected",
              "version": "7.86.0"
            },
            {
              "status": "affected",
              "version": "7.85.0"
            },
            {
              "status": "affected",
              "version": "7.84.0"
            },
            {
              "status": "affected",
              "version": "7.83.1"
            },
            {
              "status": "affected",
              "version": "7.83.0"
            },
            {
              "status": "affected",
              "version": "7.82.0"
            },
            {
              "status": "affected",
              "version": "7.81.0"
            },
            {
              "status": "affected",
              "version": "7.80.0"
            },
            {
              "status": "affected",
              "version": "7.79.1"
            },
            {
              "status": "affected",
              "version": "7.79.0"
            },
            {
              "status": "affected",
              "version": "7.78.0"
            },
            {
              "status": "affected",
              "version": "7.77.0"
            },
            {
              "status": "affected",
              "version": "7.76.1"
            },
            {
              "status": "affected",
              "version": "7.76.0"
            },
            {
              "status": "affected",
              "version": "7.75.0"
            },
            {
              "status": "affected",
              "version": "7.74.0"
            },
            {
              "status": "affected",
              "version": "7.73.0"
            },
            {
              "status": "affected",
              "version": "7.72.0"
            },
            {
              "status": "affected",
              "version": "7.71.1"
            },
            {
              "status": "affected",
              "version": "7.71.0"
            },
            {
              "status": "affected",
              "version": "7.70.0"
            },
            {
              "status": "affected",
              "version": "7.69.1"
            },
            {
              "status": "affected",
              "version": "7.69.0"
            },
            {
              "status": "affected",
              "version": "7.68.0"
            },
            {
              "status": "affected",
              "version": "7.67.0"
            },
            {
              "status": "affected",
              "version": "7.66.0"
            },
            {
              "status": "affected",
              "version": "7.65.3"
            },
            {
              "status": "affected",
              "version": "7.65.2"
            },
            {
              "status": "affected",
              "version": "7.65.1"
            },
            {
              "status": "affected",
              "version": "7.65.0"
            },
            {
              "status": "affected",
              "version": "7.64.1"
            },
            {
              "status": "affected",
              "version": "7.64.0"
            },
            {
              "status": "affected",
              "version": "7.63.0"
            },
            {
              "status": "affected",
              "version": "7.62.0"
            },
            {
              "status": "affected",
              "version": "7.61.1"
            },
            {
              "status": "affected",
              "version": "7.61.0"
            },
            {
              "status": "affected",
              "version": "7.60.0"
            },
            {
              "status": "affected",
              "version": "7.59.0"
            },
            {
              "status": "affected",
              "version": "7.58.0"
            },
            {
              "status": "affected",
              "version": "7.57.0"
            },
            {
              "status": "affected",
              "version": "7.56.1"
            },
            {
              "status": "affected",
              "version": "7.56.0"
            },
            {
              "status": "affected",
              "version": "7.55.1"
            },
            {
              "status": "affected",
              "version": "7.55.0"
            },
            {
              "status": "affected",
              "version": "7.54.1"
            },
            {
              "status": "affected",
              "version": "7.54.0"
            },
            {
              "status": "affected",
              "version": "7.53.1"
            },
            {
              "status": "affected",
              "version": "7.53.0"
            },
            {
              "status": "affected",
              "version": "7.52.1"
            },
            {
              "status": "affected",
              "version": "7.52.0"
            },
            {
              "status": "affected",
              "version": "7.51.0"
            },
            {
              "status": "affected",
              "version": "7.50.3"
            },
            {
              "status": "affected",
              "version": "7.50.2"
            },
            {
              "status": "affected",
              "version": "7.50.1"
            },
            {
              "status": "affected",
              "version": "7.50.0"
            },
            {
              "status": "affected",
              "version": "7.49.1"
            },
            {
              "status": "affected",
              "version": "7.49.0"
            },
            {
              "status": "affected",
              "version": "7.48.0"
            },
            {
              "status": "affected",
              "version": "7.47.1"
            },
            {
              "status": "affected",
              "version": "7.47.0"
            },
            {
              "status": "affected",
              "version": "7.46.0"
            },
            {
              "status": "affected",
              "version": "7.45.0"
            },
            {
              "status": "affected",
              "version": "7.44.0"
            },
            {
              "status": "affected",
              "version": "7.43.0"
            },
            {
              "status": "affected",
              "version": "7.42.1"
            },
            {
              "status": "affected",
              "version": "7.42.0"
            },
            {
              "status": "affected",
              "version": "7.41.0"
            },
            {
              "status": "affected",
              "version": "7.40.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osama Hamad"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "Exposure of Data Element to Wrong Session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:03:00.894Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2026-5773.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2026-5773.html"
        },
        {
          "url": "https://hackerone.com/reports/3650689"
        }
      ],
      "title": "wrong reuse of SMB connection",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "7.40.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.1"
                  },
                  {
                    "introduced": "8.17.0"
                  },
                  {
                    "fixed": "8.20.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "aec2e865f06669b9cb5d26cc1148d70bc418b163"
                  },
                  {
                    "fixed": "74a169575d6412dc0ff532acdf94de35a6c2a571"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.19.0",
              "8.18.0",
              "8.17.0",
              "8.16.0",
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0",
              "8.12.1",
              "8.12.0",
              "8.11.1",
              "8.11.0",
              "8.10.1",
              "8.10.0",
              "8.9.1",
              "8.9.0",
              "8.8.0",
              "8.7.1",
              "8.7.0",
              "8.6.0",
              "8.5.0",
              "8.4.0",
              "8.3.0",
              "8.2.1",
              "8.2.0",
              "8.1.2",
              "8.1.1",
              "8.1.0",
              "8.0.1",
              "8.0.0",
              "7.88.1",
              "7.88.0",
              "7.87.0",
              "7.86.0",
              "7.85.0",
              "7.84.0",
              "7.83.1",
              "7.83.0",
              "7.82.0",
              "7.81.0",
              "7.80.0",
              "7.79.1",
              "7.79.0",
              "7.78.0",
              "7.77.0",
              "7.76.1",
              "7.76.0",
              "7.75.0",
              "7.74.0",
              "7.73.0",
              "7.72.0",
              "7.71.1",
              "7.71.0",
              "7.70.0",
              "7.69.1",
              "7.69.0",
              "7.68.0",
              "7.67.0",
              "7.66.0",
              "7.65.3",
              "7.65.2",
              "7.65.1",
              "7.65.0",
              "7.64.1",
              "7.64.0",
              "7.63.0",
              "7.62.0",
              "7.61.1",
              "7.61.0",
              "7.60.0",
              "7.59.0",
              "7.58.0",
              "7.57.0",
              "7.56.1",
              "7.56.0",
              "7.55.1",
              "7.55.0",
              "7.54.1",
              "7.54.0",
              "7.53.1",
              "7.53.0",
              "7.52.1",
              "7.52.0",
              "7.51.0",
              "7.50.3",
              "7.50.2",
              "7.50.1",
              "7.50.0",
              "7.49.1",
              "7.49.0",
              "7.48.0",
              "7.47.1",
              "7.47.0",
              "7.46.0",
              "7.45.0",
              "7.44.0",
              "7.43.0",
              "7.42.1",
              "7.42.0",
              "7.41.0",
              "7.40.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2026-5773"
        ],
        "credits": [
          {
            "name": "Osama Hamad",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Exposure of Data Element to Wrong Session",
            "id": "CWE-488"
          },
          "URL": "https://curl.se/docs/CVE-2026-5773.json",
          "affects": "both",
          "issue": "https://hackerone.com/reports/3650689",
          "last_affected": "8.19.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2026-5773.html"
        },
        "details": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.",
        "id": "CURL-CVE-2026-5773",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2026-04-29T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "wrong reuse of SMB connection"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-5773",
    "datePublished": "2026-05-13T08:27:42.342Z",
    "dateReserved": "2026-04-08T06:51:05.356Z",
    "dateUpdated": "2026-09-15T06:03:00.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-5773

CVE-2026-5773 (GCVE-0-2026-5773)

Tags

Sightings

Nomenclature

Related by attack behaviour