CVE-2026-5773

EUVD-2026-29924

13.05.2026, 13:01

libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.

libcurl features a pool of recent connections so that subsequent requests can
reuse an existing connection to avoid overhead.

When reusing a connection a range of criteria must be met. Due to a logical
error in the code, a network transfer operation that was requested by an
application could wrongfully reuse an existing SMB connection to the same
server that was using a different "share" than the new subsequent transfer
should.

This could in unlucky situations lead to the download of the wrong file or the
upload of a file to the wrong place. When this happens, the same credentials
are used and the server name is the same.

SSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
curl	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 49.32%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	7.40.0 ≤ 𝑥 < 8.20.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
curl	curl	7.40.0 ≤ 𝑥 < 8.14.2	CNA
curl	curl	8.15.0 ≤ 𝑥 < 8.16.1	CNA
curl	curl	8.17.0 ≤ 𝑥 < 8.20.0	CNA
curl	curl	8.19.0	CNA
curl	curl	8.18.0	CNA
curl	curl	8.17.0	CNA
curl	curl	8.16.0	CNA
curl	curl	8.15.0	CNA
curl	curl	8.14.1	CNA
curl	curl	8.14.0	CNA
curl	curl	8.13.0	CNA
curl	curl	8.12.1	CNA
curl	curl	8.12.0	CNA
curl	curl	8.11.1	CNA
curl	curl	8.11.0	CNA
curl	curl	8.10.1	CNA
curl	curl	8.10.0	CNA
curl	curl	8.9.1	CNA
curl	curl	8.9.0	CNA
curl	curl	8.8.0	CNA
curl	curl	8.7.1	CNA
curl	curl	8.7.0	CNA
curl	curl	8.6.0	CNA
curl	curl	8.5.0	CNA
curl	curl	8.4.0	CNA
curl	curl	8.3.0	CNA
curl	curl	8.2.1	CNA
curl	curl	8.2.0	CNA
curl	curl	8.1.2	CNA
curl	curl	8.1.1	CNA
curl	curl	8.1.0	CNA
curl	curl	8.0.1	CNA
curl	curl	8.0.0	CNA
curl	curl	7.88.1	CNA
curl	curl	7.88.0	CNA
curl	curl	7.87.0	CNA
curl	curl	7.86.0	CNA
curl	curl	7.85.0	CNA
curl	curl	7.84.0	CNA
curl	curl	7.83.1	CNA
curl	curl	7.83.0	CNA
curl	curl	7.82.0	CNA
curl	curl	7.81.0	CNA
curl	curl	7.80.0	CNA
curl	curl	7.79.1	CNA
curl	curl	7.79.0	CNA
curl	curl	7.78.0	CNA
curl	curl	7.77.0	CNA
curl	curl	7.76.1	CNA
curl	curl	7.76.0	CNA
curl	curl	7.75.0	CNA
curl	curl	7.74.0	CNA
curl	curl	7.73.0	CNA
curl	curl	7.72.0	CNA
curl	curl	7.71.1	CNA
curl	curl	7.71.0	CNA
curl	curl	7.70.0	CNA
curl	curl	7.69.1	CNA
curl	curl	7.69.0	CNA
curl	curl	7.68.0	CNA
curl	curl	7.67.0	CNA
curl	curl	7.66.0	CNA
curl	curl	7.65.3	CNA
curl	curl	7.65.2	CNA
curl	curl	7.65.1	CNA
curl	curl	7.65.0	CNA
curl	curl	7.64.1	CNA
curl	curl	7.64.0	CNA
curl	curl	7.63.0	CNA
curl	curl	7.62.0	CNA
curl	curl	7.61.1	CNA
curl	curl	7.61.0	CNA
curl	curl	7.60.0	CNA
curl	curl	7.59.0	CNA
curl	curl	7.58.0	CNA
curl	curl	7.57.0	CNA
curl	curl	7.56.1	CNA
curl	curl	7.56.0	CNA
curl	curl	7.55.1	CNA
curl	curl	7.55.0	CNA
curl	curl	7.54.1	CNA
curl	curl	7.54.0	CNA
curl	curl	7.53.1	CNA
curl	curl	7.53.0	CNA
curl	curl	7.52.1	CNA
curl	curl	7.52.0	CNA
curl	curl	7.51.0	CNA
curl	curl	7.50.3	CNA
curl	curl	7.50.2	CNA
curl	curl	7.50.1	CNA
curl	curl	7.50.0	CNA
curl	curl	7.49.1	CNA
curl	curl	7.49.0	CNA
curl	curl	7.48.0	CNA
curl	curl	7.47.1	CNA
curl	curl	7.47.0	CNA
curl	curl	7.46.0	CNA
curl	curl	7.45.0	CNA
curl	curl	7.44.0	CNA
curl	curl	7.43.0	CNA
curl	curl	7.42.1	CNA
curl	curl	7.42.0	CNA
curl	curl	7.41.0	CNA
curl	curl	7.40.0	CNA

Debian Releases

Debian Product

Codename

curl

bookworm	7.88.1-10+deb12u15 fixed
bookworm (security)	vulnerable
bullseye	postponed
forky	8.22.0-1 fixed
sid	8.22.0-1 fixed
trixie	8.14.1-2+deb13u5 fixed

Ubuntu Releases

Ubuntu Product

Codename

curl

bionic	Fixed 7.58.0-2ubuntu3.24+esm10 released
focal	Fixed 7.68.0-1ubuntu2.25+esm5 released
jammy	Fixed 7.81.0-1ubuntu1.24 released
noble	Fixed 8.5.0-2ubuntu10.9 released
questing	Fixed 8.14.1-2ubuntu1.3 released
resolute	Fixed 8.18.0-1ubuntu2.1 released
trusty	not-affected
xenial	Fixed 7.47.0-1ubuntu2.19+esm17 released

openSUSE / SLES Releases

openSUSE Product

Release

curl

suse enterprise desktop 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise sap 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise sap 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise server 15 SP4	8.14.1-150400.5.91.1 fixed
suse enterprise server 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise server 15 SP7	8.14.1-150700.7.23.1 fixed

libcurl-devel

suse enterprise desktop 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise sap 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise sap 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise server 15 SP4	8.14.1-150400.5.91.1 fixed
suse enterprise server 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise server 15 SP7	8.14.1-150700.7.23.1 fixed

libcurl4

suse enterprise desktop 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise sap 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise sap 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise server 15 SP4	8.14.1-150400.5.91.1 fixed
suse enterprise server 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise server 15 SP7	8.14.1-150700.7.23.1 fixed

libcurl4-32bit

suse enterprise desktop 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise sap 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise sap 15 SP7	8.14.1-150700.7.23.1 fixed
suse enterprise server 15 SP4	8.14.1-150400.5.91.1 fixed
suse enterprise server 15 SP6	8.14.1-150600.4.51.1 fixed
suse enterprise server 15 SP7	8.14.1-150700.7.23.1 fixed

Known Exploits!

Common Weakness Enumeration

References

https://curl.se/docs/CVE-2026-5773.html

https://curl.se/docs/CVE-2026-5773.json

https://hackerone.com/reports/3650689

http://www.openwall.com/lists/oss-security/2026/04/29/9

https://hackerone.com/reports/3650689