Vulnerability · Published May 13, 2026 · Assigned by curl
CVE-2026-5773wrong reuse of SMB connection
High 7.5
In plain English
A high-severity security flaw in curl from curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | curl | 8.14.1-r3 | ALPINE-CVE-2026-5773 |
| Alpine:v3.22 | curl | 8.14.1-r4 | ALPINE-CVE-2026-5773 |
| Alpine:v3.23 | curl | 8.20.0-r0 | ALPINE-CVE-2026-5773 |
| Alpine:v3.24 | curl | 8.20.0-r0 | ALPINE-CVE-2026-5773 |
| Debian:12 | curl | 7.88.1-10+deb12u15 | DEBIAN-CVE-2026-5773 |
| Debian:13 | curl | 8.14.1-2+deb13u4 | DEBIAN-CVE-2026-5773 |
| Debian:14 | curl | 8.20.0~rc2-1 | DEBIAN-CVE-2026-5773 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.24 | UBUNTU-CVE-2026-5773 |
| Ubuntu:24.04:LTS | curl | 8.5.0-2ubuntu10.9 | UBUNTU-CVE-2026-5773 |
| Ubuntu:25.10 | curl | 8.14.1-2ubuntu1.3 | UBUNTU-CVE-2026-5773 |
| Ubuntu:26.04:LTS | curl | 8.18.0-1ubuntu2.1 | UBUNTU-CVE-2026-5773 |
Affected products (as reported)
Weakness: CWE-488 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N