high 7.5

CVE-2026-5773 json

wrong reuse of SMB connection

published 2026-05-13 5 mo ago modified 2026-09-15 55 d ago also EUVD-2026-29924 , GHSA-rp9q-8q5w-ch44 , JLSEC-2026-1205

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.

libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should.

This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

Patch / fix

fixed in 3 distros 6 links 2

julia CURL_jll 8.20.0+0
julia LibCURL_jll 8.20.0+0
curl curl 8.14.2, 8.16.1, 8.20.0

debian ubuntu red hat suse opensuse alpine

curl Debian 12 7.88.1-10+deb12u15
curl Debian 13 8.14.1-2+deb13u4
curl Debian 14 8.20.0~rc2-1

debian advisories DEBIAN-CVE-2026-5773

curl Ubuntu 22.04 LTS 7.81.0-1ubuntu1.24
curl Ubuntu 24.04 LTS 8.5.0-2ubuntu10.9
curl Ubuntu 25.10 8.14.1-2ubuntu1.3
curl Ubuntu 26.04 LTS 8.18.0-1ubuntu2.1
curl Ubuntu Pro 16.04 LTS 7.47.0-1ubuntu2.19+esm17
curl Ubuntu Pro 18.04 LTS 7.58.0-2ubuntu3.24+esm10
curl Ubuntu Pro 20.04 LTS 7.68.0-1ubuntu2.25+esm5

ubuntu advisories UBUNTU-CVE-2026-5773

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

curl hummingbird 1 8.20.0-0.1.hum1
libcurl hummingbird 1 8.20.0-0.1.hum1
libcurl-minimal hummingbird 1 8.20.0-0.1.hum1

red hat advisories RHSA-2026:12916

curl SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 8.14.1-160000.9.1
curl-mini SLES for SAP applications 16.0, SLES 16.0 8.14.1-160000.9.1
curl SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 8.14.1-150400.5.91.1
curl Linux Micro 6.0 8.14.1-8.1
curl Linux Micro 6.1 8.14.1-slfo.1.1_9.1
curl SLE Module for Basesystem 15 SP7 8.14.1-150700.7.23.1
curl SLES for SAP 15 SP6, SLES 15 SP6-LTSS 8.14.1-150600.4.51.1
curl SLES LTSS Extended Security 12 SP5 8.0.1-11.123.1

suse advisories SUSE-SU-2026:4047-1 SUSE-SU-2026:23498-1 SUSE-SU-2026:23638-1 SUSE-SU-2026:3958-1 SUSE-SU-2026:23361-1 SUSE-SU-2026:23350-1

curl openSUSE Leap 16.0 8.14.1-160000.9.1
curl openSUSE Tumbleweed 8.20.0-1.1

opensuse advisories openSUSE-SU-2026:21774-1 openSUSE-SU-2026:10674-1

curl Alpine 3.21 8.14.1-r3
curl Alpine 3.22 8.14.1-r4
curl Alpine 3.24, Alpine 3.23 8.20.0-r0

alpine advisories ALPINE-CVE-2026-5773

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

curl.se/docs/CVE-2026-5773.html advisory
openwall.com/lists/oss-security/2026/04/29/9 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5773 updated 2026-11-06 cvss 6.5

curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse

Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-operator-bundle, openshift-sandboxed-containers/osc-podvm-builder-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9, confidential-compute-attestation-tech-preview/trustee-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/log-file-metric-exporter-rhel9, +1 more Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 7 curl, libcurl Red Hat Enterprise Linux 8 curl, libcurl, libcurl-minimal Red Hat Enterprise Linux 9 curl, rust, cargo, clippy, libcurl, rustfmt, +14 more

+6 more productsfewer

Red Hat Enterprise Linux 10 curl, rust, snphost, trustee, s390utils, trustee-guest-components Red Hat Enterprise Linux AI (RHEL AI) 3 rust Red Hat JBoss Core Services curl Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9

affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
under investigation
Red Hat Hardened Images curl 8.20.0-0.1.hum1, libcurl 8.20.0-0.1.hum1, libcurl-minimal 8.20.0-0.1.hum1
fixed: vendor fix RHSA-2026:12916
Red Hat Hardened Images rust Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago (2026-05-13)

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

hackerone.com https://hackerone.com/reports/3650689 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
julia	CURL_jll	<8.20.0+0	8.20.0+0
julia	LibCURL_jll	<8.20.0+0	8.20.0+0

Affected products

curl curl

Classification

Weakness

CWE-488 Exposure of Data Element to Wrong Session
CWE-918 Server-Side Request Forgery

References

curl.se /docs/CVE-2026-5773.html
patch, vendor-advisory, web
openwall.com /lists/oss-security/2026/04/29/9
mailing-list, patch, third-party-advisory, web
hackerone.com /reports/3650689
exploit, issue-tracking, third-party-advisory, web
curl.se /docs/CVE-2026-5773.json
vendor-advisory, web
github.com /advisories/GHSA-rp9q-8q5w-ch44
web
nvd.nist.gov /vuln/detail/CVE-2026-5773
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary