Affected: AlmaLinux:10: curl, AlmaLinux:10: libcurl, AlmaLinux:10: libcurl-devel, AlmaLinux:10: libcurl-minimal

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

curl-8.21.0-1.1 on GA media

curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: libcurl: Unauthorized connection reuse due to a logical error curl: curl: Cookie injection via malicious HTTP server using super cookies curl: curl: Double-free vulnerability in SASL authentication curl: curl: Information disclosure via incorrect .netrc password lookup curl: Information disclosure due to uncleared proxy authentication state libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback libcurl: libcurl: Information disclosure due to persistent Referer header curl: curl: Man-in-the-middle attack via SSH host key bypass curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse curl: curl: Denial of Service via WebSocket PING flood curl: curl: Information disclosure via incorrect Digest authentication header reuse curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

Affected: Rocky Linux:10: curl

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

* curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

* libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for curl

Affected: Ubuntu:25.10: curl, Ubuntu:26.04:LTS: curl

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.