CVE-2026-5773: wrong reuse of SMB connection
Last updated 10 July 2026
Other sources
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 8.14.1-2+deb13u4Fixed in 8.20.0-5Fixed in 8.21.0-2 - Configuration
Avoid using SMB(S) transfers with libcurl to prevent wrong reuse of an existing SMB connection for subsequent transfers to a different 'share' (CVE-2026-5773).
libcurl SMB(S) connection reuse behavior = Avoid using SMB(S)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5773?
CVE-2026-5773 has a medium severity rating due to the potential for unauthorized data access in SMB transfers.
How do I fix CVE-2026-5773?
To mitigate CVE-2026-5773, update libcurl to a version beyond 8.20.0, as this issue has been addressed in subsequent releases.
What impact does CVE-2026-5773 have on my system?
CVE-2026-5773 can lead to data being transferred over an incorrect SMB connection, potentially exposing sensitive information.
Is CVE-2026-5773 exploitable in all environments?
CVE-2026-5773 is primarily exploitable in environments using libcurl for SMB(S) transfers where connection reuse occurs.
What versions of libcurl are affected by CVE-2026-5773?
CVE-2026-5773 affects libcurl versions from 7.40.0 to 8.20.0 inclusive.