CVE-2026-5773

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

• CWE-918

• https://curl.se/docs/CVE-2026-5773.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2026-5773.jsonVendor Advisory
• https://hackerone.com/reports/3650689Exploit, Issue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/04/29/9Mailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/3650689Exploit, Issue Tracking, Third Party Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57724Deserialization of Untrusted Data vulnerability in Themeum K…9.8
• CVE-2026-57725Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57726Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-57727Missing Authorization vulnerability in Themeum Kirki kirki a…7.5
• CVE-2026-57728Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57729Missing Authorization vulnerability in UX-themes Flatsome fl…7.5
• CVE-2026-57730Subscriber Broken Access Control in Flatsome <= 3.20.5 versi…4.3
• CVE-2026-57731Contributor Broken Access Control in Flatsome <= 3.20.5 vers…6.5
• CVE-2026-57732Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57733Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57734Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-57735Unauthenticated Cross Site Scripting (XSS) in Breakdance <= …7.1