Is CVE-2026-5773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5773 being exploited in the wild.

How severe is CVE-2026-5773?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Is there a fix for CVE-2026-5773?

A patch was published on 2026-04-29: Fixed in version 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5773 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5773?

Check whether you run Haxx Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5773: libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent…

CVE-2026-5773 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in the curl library, which is widely used by applications to transfer data, could cause the software to reuse the wrong network connection when communicating with file servers. This flaw occurs when using the SMB protocol and could result in an application downloading the wrong file or uploading sensitive data to an unintended folder on the same server. This could lead to unauthorized data exposure or the corruption of files on corporate network shares.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-5773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5773 being exploited in the wild.
How severe is CVE-2026-5773?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: Haxx Curl 7.40.0 to 8.19.0.
Is there a fix for CVE-2026-5773?: A patch was published on 2026-04-29: Fixed in version 8.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5773 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5773?: Check whether you run Haxx Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logical error in libcurl's connection pooling mechanism fails to validate the 'share' name when attempting to reuse an existing SMB(S) connection. While the library correctly matches the server name and credentials, it ignores the specific share path, allowing a subsequent request intended for one share to be executed over a connection established for another. This vulnerability (CWE-488) affects curl versions 7.40.0 through 8.19.0. An attacker or an unlucky sequence of application requests could result in files being read from or written to the wrong location. The issue is resolved in version 8.20.0 by disabling SMB connection reuse entirely.

Affected products

haxx curl 7.40.0 to 8.19.0

Timeline

2026-04-05: disclosed: Reported to the curl project
2026-04-29: patched: Fixed in version 8.20.0
2026-05-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.