wrong reuse of SMB connection

Description

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

Scores

EPSS (exploitation in 30 days)

0.62% · top 50% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-488: Exposure of Data Element to Wrong Session (opens in a new tab)All about CWE-488 and its CVEs
• CWE-918 (opens in a new tab)All about CWE-918 and its CVEs

Affected products

• curl · curl

  • affected 7.40.0 – < 8.14.2
  • affected 8.15.0 – < 8.16.1
  • affected 8.17.0 – < 8.20.0

• curl · curl

  • affected aec2e865f06669b9cb5d26cc1148d70bc418b163 – < 74a169575d6412dc0ff532acdf94de35a6c2a571

• curl · curl

  • affected 8.19.0
  • affected 8.18.0
  • affected 8.17.0
  • affected 8.16.0
  • affected 8.15.0
  • affected 8.14.1
  • affected 8.14.0
  • affected 8.13.0
  • affected 8.12.1
  • affected 8.12.0
  • affected 8.11.1
  • affected 8.11.0
  • affected 8.10.1
  • affected 8.10.0
  • affected 8.9.1
  • affected 8.9.0
  • affected 8.8.0
  • affected 8.7.1
  • affected 8.7.0
  • affected 8.6.0
  • affected 8.5.0
  • affected 8.4.0
  • affected 8.3.0
  • affected 8.2.1
  • affected 8.2.0
  • affected 8.1.2
  • affected 8.1.1
  • affected 8.1.0
  • affected 8.0.1
  • affected 8.0.0
  • affected 7.88.1
  • affected 7.88.0
  • affected 7.87.0
  • affected 7.86.0
  • affected 7.85.0
  • affected 7.84.0
  • affected 7.83.1
  • affected 7.83.0
  • affected 7.82.0
  • affected 7.81.0
  • and 61 more

References (4)

• https://curl.se/docs/CVE-2026-5773.json (opens in a new tab)
• https://curl.se/docs/CVE-2026-5773.html (opens in a new tab)
• https://hackerone.com/reports/3650689 (opens in a new tab)exploit
• http://www.openwall.com/lists/oss-security/2026/04/29/9 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-5773](https://trackcve.app/badge/CVE-2026-5773.svg)](https://trackcve.app/cve/CVE-2026-5773)

Record last updated 15 Sept 2026, 06:03 UTC.