CVE-2026-5773General(haxx / curl)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch haxx curl systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different "share" than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.

haxx CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Vendor / third-party advisories

https://curl.se/docs/CVE-2026-5773.json

Weakness type (CWE)

CWE-488CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

curl

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
General: 3 classified signals
Peaked 2d ago at 2 mentions (2026-04-30); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

haxx

Products

curl

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

General

360.0%

Patch

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-29	1	General1
2026-04-30	2	General1Patch1
2026-05-02	1	General1
2026-05-11	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security161d
Patch
8 CVEs fixed in curl https://www.openwall.com/lists/oss-security/2026/04/29/ CVE-2026-4873: connection reuse ignores TLS requirement CVE-2026-5545: wrong reuse of HTTP Negotiate connection CVE-2026-5773: wrong reuse of SMB connection CVE-2026-6429: netrc credential leak with reused proxy connection 1/2
Post summary
The post announces that eight CVEs in curl have been fixed, providing brief technical descriptions and implying that vendor patches are available.
12070495
4.7K followersView on X
H1 Disclosed - Public Disclosures@h1Disclosed159d
General
⚡ CVE-2026-5773: wrong reuse of SMB connection 👨🏻‍💻 @about_testing ➟ curl 🟨 Low 💰 None 🔗 https://hackerone.com/reports/3650689 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/QOVY2U5nFO
Post summary
CVE-2026-5773 is reported as a low‑severity issue related to incorrect SMB connection reuse, documented in a HackerOne bounty report. No proof of concept, exploit, patch, or active exploitation information is provided.
01060544
10.2K followersView on X
草薙沙耶(KUSANAGI)@kusanagi_saya150d
Patch
kusanagi-curl モジュール更新情報 8.20.0-1 https://kusanagi.tokyo/releases/24476/ KUSANAGI 9 を構成している各モジュールのアップデートを行いました。アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.20.0-1 この更新には脆弱性(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2...
Post summary
This update for KUSANAGI 9, particularly the curl module, provides patches for a set of CVEs, indicating the vulnerability is being addressed through a new release.
0101085
200 followersView on X
Autumn Good@autumn_good_35160d
General
curlで8件の脆弱性 CVE-2026-7168 CVE-2026-7009 CVE-2026-6429 CVE-2026-6276 CVE-2026-6253 CVE-2026-5773 CVE-2026-5545 CVE-2026-4873 Published vulnerabilities for curl/libcurl https://curl.se/docs/security.html
Post summary
The text lists eight curl CVEs and links to the library’s security page, but provides no exploit details, patches, or technical specifics.
00000396
6.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds162d
General
CVE-2026-5773 [ADVISORY] curl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5773
Post summary
The snippet references CVE-2026-5773 for curl and provides a link to Vulmon for advisory details, but offers no further technical or exploit information.
0000043
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haxx	curl	-	-	-

Explore more

Back to dashboard haxx CVEs curl vulnerabilities

What researchers are saying

CVE-2026-5773

Open Source Security mailing list@oss_securityPatch

The post announces that eight CVEs in curl have been fixed, providing brief technical descriptions and implying that vendor patches are available.

H1 Disclosed - Public Disclosures@h1DisclosedGeneral

CVE-2026-5773 is reported as a low‑severity issue related to incorrect SMB connection reuse, documented in a HackerOne bounty report. No proof of concept, exploit, patch, or active exploitation information is provided.

草薙沙耶(KUSANAGI)@kusanagi_sayaPatch

This update for KUSANAGI 9, particularly the curl module, provides patches for a set of CVEs, indicating the vulnerability is being addressed through a new release.

Autumn Good@autumn_good_35General

The text lists eight curl CVEs and links to the library’s security page, but provides no exploit details, patches, or technical specifics.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The snippet references CVE-2026-5773 for curl and provides a link to Vulmon for advisory details, but offers no further technical or exploit information.