RHSA-2026:77255
Vulnerability from csaf_redhat - Published: 2026-10-07 01:32 - Updated: 2026-10-14 03:09Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
curl:
* curl-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)
* libcurl-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)
* libcurl-devel-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)
* libcurl-minimal-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)
* curl-8.22.0-1.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
5.3 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.
4.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.
6.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.
6.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.
5.7 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.
6.5 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
References
51 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ncurl:\n * curl-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-devel-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-minimal-8.22.0-1.1.hum1 (aarch64, s390x, x86_64)\n * curl-8.22.0-1.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:77255",
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-9086",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14819",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3783",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3784",
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1965",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14017",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77255.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-14T03:09:54+00:00",
"generator": {
"date": "2026-10-14T03:09:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:77255",
"initial_release_date": "2026-10-07T01:32:15+00:00",
"revision_history": [
{
"date": "2026-10-07T01:32:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-12T08:43:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-14T03:09:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.22.0-1.1.hum1@aarch64",
"product": {
"name": "curl-0:8.22.0-1.1.hum1@aarch64",
"product_id": "curl-0:8.22.0-1.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.22.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.22.0-1.1.hum1@aarch64",
"product": {
"name": "libcurl-0:8.22.0-1.1.hum1@aarch64",
"product_id": "libcurl-0:8.22.0-1.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.22.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"product": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"product_id": "libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.22.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"product": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"product_id": "libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.22.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.22.0-1.1.hum1@s390x",
"product": {
"name": "curl-0:8.22.0-1.1.hum1@s390x",
"product_id": "curl-0:8.22.0-1.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.22.0-1.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.22.0-1.1.hum1@s390x",
"product": {
"name": "libcurl-0:8.22.0-1.1.hum1@s390x",
"product_id": "libcurl-0:8.22.0-1.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.22.0-1.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"product": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"product_id": "libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.22.0-1.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"product": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"product_id": "libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.22.0-1.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.22.0-1.1.hum1@src",
"product": {
"name": "curl-0:8.22.0-1.1.hum1@src",
"product_id": "curl-0:8.22.0-1.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.22.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.22.0-1.1.hum1@x86_64",
"product": {
"name": "curl-0:8.22.0-1.1.hum1@x86_64",
"product_id": "curl-0:8.22.0-1.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.22.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.22.0-1.1.hum1@x86_64",
"product": {
"name": "libcurl-0:8.22.0-1.1.hum1@x86_64",
"product_id": "libcurl-0:8.22.0-1.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.22.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"product": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"product_id": "libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.22.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@x86_64",
"product": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@x86_64",
"product_id": "libcurl-minimal-0:8.22.0-1.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.22.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.22.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64"
},
"product_reference": "curl-0:8.22.0-1.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.22.0-1.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x"
},
"product_reference": "curl-0:8.22.0-1.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.22.0-1.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src"
},
"product_reference": "curl-0:8.22.0-1.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.22.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64"
},
"product_reference": "curl-0:8.22.0-1.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.22.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64"
},
"product_reference": "libcurl-0:8.22.0-1.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.22.0-1.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x"
},
"product_reference": "libcurl-0:8.22.0-1.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.22.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64"
},
"product_reference": "libcurl-0:8.22.0-1.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64"
},
"product_reference": "libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x"
},
"product_reference": "libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.22.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64"
},
"product_reference": "libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64"
},
"product_reference": "libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x"
},
"product_reference": "libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.22.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
},
"product_reference": "libcurl-minimal-0:8.22.0-1.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9086",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-09-12T06:01:02.244669+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2394750"
}
],
"notes": [
{
"category": "description",
"text": "An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Curl out of bounds read for cookie path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "RHBZ#2394750",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394750"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.html",
"url": "https://curl.se/docs/CVE-2025-9086.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.json",
"url": "https://curl.se/docs/CVE-2025-9086.json"
},
{
"category": "external",
"summary": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6",
"url": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3294999",
"url": "https://hackerone.com/reports/3294999"
}
],
"release_date": "2025-09-12T05:10:03.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Curl out of bounds read for cookie path"
},
{
"cve": "CVE-2025-14017",
"cwe": {
"id": "CWE-1058",
"name": "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element"
},
"discovery_date": "2026-01-08T11:01:16.184214+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. The flaw in curl affects multi-threaded LDAPS transfers where changes to TLS options in one thread could inadvertently apply globally, impacting other concurrent transfers. This could lead to a security bypass if an application relies on specific TLS settings that are then overridden. Impact is limited to applications utilizing libcurl for multi-threaded LDAPS connections that dynamically modify TLS options.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "RHBZ#2427870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.html",
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.json",
"url": "https://curl.se/docs/CVE-2025-14017.json"
}
],
"release_date": "2026-01-08T10:07:05.554000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers"
},
{
"cve": "CVE-2025-14819",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2025-12-31T03:46:56.325000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server\u0027s security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat. `libcurl` could incorrectly reuse a cached CA store when applications alter the `CURLSSLOPT_NO_PARTIALCHAIN` option with re-used easy or multi handles. This could lead to the acceptance of an otherwise untrusted TLS trust chain. Exploitation requires specific application logic that dynamically changes this option while reusing `libcurl` handles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "RHBZ#2426408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14819.html",
"url": "https://curl.se/docs/CVE-2025-14819.html"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse"
},
{
"cve": "CVE-2026-1965",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-03-11T11:00:54.752485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "RHBZ#2446448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.html",
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.json",
"url": "https://curl.se/docs/CVE-2026-1965.json"
}
],
"release_date": "2026-03-11T10:08:52.431000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication"
},
{
"cve": "CVE-2026-3783",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-03-11T11:01:01.429907+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "RHBZ#2446450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/2",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.html",
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.json",
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3583983",
"url": "https://hackerone.com/reports/3583983"
}
],
"release_date": "2026-03-11T10:09:08.746000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "workaround",
"details": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect"
},
{
"cve": "CVE-2026-3784",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-03-11T11:00:57.752827+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446449"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"category": "external",
"summary": "RHBZ#2446449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446449"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/3",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3784.html",
"url": "https://curl.se/docs/CVE-2026-3784.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3784.json",
"url": "https://curl.se/docs/CVE-2026-3784.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3584903",
"url": "https://hackerone.com/reports/3584903"
}
],
"release_date": "2026-03-11T10:09:21.418000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-07T01:32:15+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:77255"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.22.0-1.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.22.0-1.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…