RHSA-2026:55432: Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.Security Fix(es): curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.4.aa
Event History
Frequently Asked Questions
Which installed components should be included in remediation checks?
Check for curl, libcurl, libcurl-minimal, libcurl-devel, and their debuginfo or debugsource packages listed in the advisory. Applications that use libcurl should also be considered because the issue concerns proxy authentication state.
Does the advisory provide a workaround or identify whether default configurations are affected?
No. The provided advisory information does not describe a workaround, affected default configuration, or a method to determine whether proxy authentication state has already been exposed.