RHSA-2026:99643: Red Hat Security Advisory: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.Security Fix(es): curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers (CVE-2026-6276) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 0:8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/curl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/curl-debugsourceto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/libcurlto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/libcurl-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/libcurl-develto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/libcurl-minimalto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa - Upgrade
Upgrade
redhat/libcurl-minimal-debuginfoto a version that resolves this vulnerability.Fixed in 8.12.1-4.el10_2.9.aa
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker would need to cause libcurl to reuse a connection while custom Host headers are in use. The issue is an information disclosure through cookie leakage; the provided data does not identify specific affected application configurations.
Which installed components should be included in remediation checks?
Review installations of curl, libcurl, libcurl-minimal, curl-debuginfo, curl-debugsource, libcurl-debuginfo, libcurl-devel, and libcurl-minimal-debuginfo from Red Hat. The advisory identifies these packages as part of the security update.
How urgent is this update?
The advisory rates the issue low severity with a CVSS score of 3.7. The supplied vector indicates network reachability, high attack complexity, no required privileges or user interaction, and low confidentiality impact only.