Affected: AlmaLinux:10: curl, AlmaLinux:10: libcurl, AlmaLinux:10: libcurl-devel, AlmaLinux:10: libcurl-minimal

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Affected: openEuler:20.03-LTS-SP4: curl

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):

['Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'](CVE-2026-8932)

curl-8.21.0-1.1 on GA media

curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: libcurl: Unauthorized connection reuse due to a logical error curl: curl: Cookie injection via malicious HTTP server using super cookies curl: curl: Double-free vulnerability in SASL authentication curl: curl: Information disclosure via incorrect .netrc password lookup curl: Information disclosure due to uncleared proxy authentication state libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback libcurl: libcurl: Information disclosure due to persistent Referer header curl: curl: Man-in-the-middle attack via SSH host key bypass curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse curl: curl: Denial of Service via WebSocket PING flood curl: curl: Information disclosure via incorrect Digest authentication header reuse curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

Affected: Rocky Linux:10: curl

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

* curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

* libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Ubuntu:Pro:14.04:LTS: curl, Ubuntu:Pro:16.04:LTS: curl, Ubuntu:Pro:18.04:LTS: curl, Ubuntu:Pro:20.04:LTS: curl, Ubuntu:22.04:LTS: curl, Ubuntu:24.04:LTS: curl, Ubuntu:25.10: curl, Ubuntu:26.04:LTS: curl

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.