JLSEC-2026-1205
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-1205.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1205.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/JLSEC-2026-1205
- Upstream
- Published
- 2026-08-07T20:11:58.984Z
- Modified
- 2026-08-07T20:29:10.903941571Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl...
- Details
-
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should.
This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same.
- Database specific
{ "license": "CC-BY-4.0", "sources": [ { "imported": "2026-08-07T19:54:38.615Z", "database_specific": { "status": "Analyzed" }, "id": "CVE-2026-5773", "published": "2026-05-13T13:01:56.307Z", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-5773", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "modified": "2026-06-17T10:59:37.340Z" }, { "imported": "2026-08-07T19:56:09.568Z", "id": "GHSA-rp9q-8q5w-ch44", "html_url": "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "url": "https://api.github.com/advisories/GHSA-rp9q-8q5w-ch44", "published": "2026-05-13T18:30:52Z", "modified": "2026-05-13T21:32:05Z" }, { "imported": "2026-08-07T19:55:22.670Z", "id": "EUVD-2026-29924", "published": "2026-05-13T08:27:42Z", "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-29924", "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29924", "modified": "2026-05-13T17:45:08Z" } ] }- References
Affected packages
Julia / CURL_jll
Package
- Name
- CURL_jll
- Purl
- pkg:julia/CURL_jll?uuid=b21e61f3-bafc-59ac-ab14-4c5c62d6588d