High 7.5Published May 13, 2026

CVE-2026-5773wrong reuse of SMB connection

Updated under an hour ago (Oct 26, 2026, 1:50 PM ET)

Does this affect you?

It affects curl and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for curl

Exploited in the last 30 days

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

CVSS: 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-488
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: curl
NVD analysis: Modified
Record last updated: Sep 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

curl curl curl:curl (from the name)	from 7.40.0 before 8.14.2; from 8.15.0 before 8.16.1; from 8.17.0 before 8.20.0	CNA record
haxx curl haxx:curl	from 7.40.0 before 8.20.0	NVD

References

References

https://curl.se/docs/CVE-2026-5773.json	vendor-advisory
https://curl.se/docs/CVE-2026-5773.html	patch, vendor-advisory
https://hackerone.com/reports/3650689	exploit, issue-tracking, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/04/29/9	mailing-list, patch, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.