RHSA-2026:57462: Important: curl security, bug fix, and enhancement update
Important: curl security, bug fix, and enhancement update
Other sources
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.Security Fix(es): curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286) Bug Fix(es) and Enhancement(s): Regression of RHEL-73788. The .9 revision appears to have broken the logic that forces NTLM to use HTTP/1.1. (JIRA:RHEL-171912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/curl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/curl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.61.1-34.el8_10.13.aa - Upgrade
Upgrade
curlto a version that resolves this vulnerability.Patch RHEL-171912
Event History
Frequently Asked Questions
Which systems are covered by this update?
The advisory applies to Red Hat Enterprise Linux for x86_64, ARM 64, IBM z Systems, and Power little endian. It also covers the Extended Life Cycle variants listed for each of those architectures.
What type of update is this?
This is an Important-severity curl update that includes security fixes, bug fixes, and enhancements. The provided data does not identify the individual vulnerabilities, affected curl versions, or fixed package versions.