CVE-2026-5773

216.73.217.80

· Published 13/05/2026 13:01 · Modified 13/05/2026 19:13

Labels: CVE-2026-5773 2026-05-13 2499f714-1537-4658-8207-48ae4bb9eae9 CVE-2026-5773 CWE-918

Essential information

Published: 13/05/2026 13:01
Modified: 13/05/2026 19:13
Author: —
Creator: —
CVSS: 7.5 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS metrics

Description

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

NVD status

Status: Analyzed — CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
NVD: View on NVD

Affected products (CPE)

Product	CPE
haxx / curl	`cpe:2.3:a:haxx:curl::::::::`