RHSA-2026:93454: Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.Security Fix(es): curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965) curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783) curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547) libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286) curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/curl-minimalto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/curl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/curl-minimalto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/curl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 7.76.1-31.el9_6.4.aa
Event History
Frequently Asked Questions
Which curl or libcurl usage patterns should be prioritized for review?
Prioritize clients that use Negotiate, Digest, OAuth2 bearer tokens with HTTP(S) redirects, SSH host-key verification, mutual TLS, proxy authentication, or shared/reused connections. Clients that accept cookies from untrusted HTTP servers should also be reviewed.
Is there an interim mitigation listed if the packages cannot be updated immediately?
No interim mitigations or configuration workarounds are provided in this advisory.
Does the advisory identify affected or fixed package versions?
No affected or fixed package versions are included in the provided advisory text. It directs readers to the listed CVE pages for additional issue details.