Exposure of Data Element to Wrong Session in cURL - CVE-2026-5773

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128451

Exposure of Data Element to Wrong Session in cURL - CVE-2026-5773

Published: April 29, 2026


Vulnerability identifier: #VU128451
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-5773
CWE-ID: CWE-488
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper reuse of connection for SMB(S) transfers. A remote attacker can gain access to sensitive information on the system.


Affected software

cURL
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
Ubuntu
openEuler
Anolis OS
curl (Ubuntu package)
curl
curl-debuginfo
curl-debugsource
libcurl
libcurl-devel
curl-help
libcurl4-debuginfo
libcurl4-32bit
libcurl4-debuginfo-32bit
libcurl4
curl-doc
libcurl-minimal
curl-minimal

How to mitigate CVE-2026-5773

Install updates from vendor's website.

cURL - update to 8.20.0
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm21, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 7.81.0-1ubuntu1.24, 8.5.0-2ubuntu10.9, 8.5.0-2ubuntu10.11, 8.14.1-2ubuntu1.3, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.1, 8.18.0-1ubuntu2.3
curl - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
curl-debuginfo - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
curl-debugsource - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
libcurl - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
libcurl-devel - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
curl-help - addressed in versions 7.71.1-48, 7.79.1-49, 8.4.0-29, 8.4.0-30
libcurl-devel - update to 8.0.1-11.123.1
libcurl4-debuginfo - update to 8.0.1-11.123.1
curl - update to 8.0.1-11.123.1
curl-debuginfo - update to 8.0.1-11.123.1
libcurl4-32bit - update to 8.0.1-11.123.1
libcurl4-debuginfo-32bit - update to 8.0.1-11.123.1
libcurl4 - update to 8.0.1-11.123.1
curl-debugsource - update to 8.0.1-11.123.1
curl-doc - update to 8.4.0-17
libcurl-minimal - update to 8.4.0-17
libcurl-devel - update to 8.4.0-17
libcurl - update to 8.4.0-17
curl-minimal - update to 8.4.0-17
curl - update to 8.4.0-17

External References

Related Security Bulletins