RHSA-2026:82895
Vulnerability from csaf_redhat - Published: 2026-10-14 11:39 - Updated: 2026-10-17 12:55Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
curl:
* curl-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)
* libcurl-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)
* libcurl-devel-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)
* libcurl-minimal-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)
* curl-8.23.0-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
5.3 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.
4.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.
6.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure.
5.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host's identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure.
6.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol (FTP) transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security (TLS), curl fails to perform a new handshake or authentication. As a result, the subsequent transfer operates under the prior session's identity, allowing it to perform operations on the remote server with unintended authorization.
5.9 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
No description is available for this CVE.
5.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data.
5.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server's credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens.
6.5 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests intended for one server to be transmitted over an established connection to another, potentially resulting in information disclosure.
CWE-201 - Insertion of Sensitive Information Into Sent DataAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When importing HTTP Strict Transport Security (HSTS) cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade subsequent connections for the subdomain to HTTPS and transmits unencrypted requests, allowing a network attacker to intercept sensitive data.
CWE-201 - Insertion of Sensitive Information Into Sent DataAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When persistent HTTP Strict Transport Security (HSTS) caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this serialization failure causes the persistent HSTS cache to be deleted or emptied. As a result, stored security policies for known hosts are lost, potentially allowing future connections to fall back to insecure communication.
CWE-201 - Insertion of Sensitive Information Into Sent DataAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session.
CWE-130 - Improper Handling of Length Parameter InconsistencyAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data.
CWE-295 - Improper Certificate ValidationAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake.
CWE-295 - Improper Certificate ValidationAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored.
4.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS).
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access.
6.5 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Moderate
A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker's server.
CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system.
6.5 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS).
CWE-674 - Uncontrolled RecursionAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS).
8.1 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Important
A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries.
CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL.
CWE-522 - Insufficiently Protected CredentialsAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS).
4.8 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.
CWE-488 - Exposure of Data Element to Wrong SessionAffected products
Fixed
13 products, the same list as for
CVE-2025-9086
Threats
Impact
Low
References
141 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ncurl:\n * curl-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-devel-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)\n * libcurl-minimal-8.23.0-0.1.hum1 (aarch64, s390x, x86_64)\n * curl-8.23.0-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:82895",
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92392",
"url": "https://access.redhat.com/security/cve/CVE-2026-92392"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92388",
"url": "https://access.redhat.com/security/cve/CVE-2026-92388"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86414",
"url": "https://access.redhat.com/security/cve/CVE-2026-86414"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14017",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-9086",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14819",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86410",
"url": "https://access.redhat.com/security/cve/CVE-2026-86410"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92389",
"url": "https://access.redhat.com/security/cve/CVE-2026-92389"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94265",
"url": "https://access.redhat.com/security/cve/CVE-2026-94265"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-107928",
"url": "https://access.redhat.com/security/cve/CVE-2026-107928"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87866",
"url": "https://access.redhat.com/security/cve/CVE-2026-87866"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94266",
"url": "https://access.redhat.com/security/cve/CVE-2026-94266"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-107929",
"url": "https://access.redhat.com/security/cve/CVE-2026-107929"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92386",
"url": "https://access.redhat.com/security/cve/CVE-2026-92386"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92391",
"url": "https://access.redhat.com/security/cve/CVE-2026-92391"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92390",
"url": "https://access.redhat.com/security/cve/CVE-2026-92390"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86413",
"url": "https://access.redhat.com/security/cve/CVE-2026-86413"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92387",
"url": "https://access.redhat.com/security/cve/CVE-2026-92387"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87865",
"url": "https://access.redhat.com/security/cve/CVE-2026-87865"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87863",
"url": "https://access.redhat.com/security/cve/CVE-2026-87863"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87864",
"url": "https://access.redhat.com/security/cve/CVE-2026-87864"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87862",
"url": "https://access.redhat.com/security/cve/CVE-2026-87862"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87861",
"url": "https://access.redhat.com/security/cve/CVE-2026-87861"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86409",
"url": "https://access.redhat.com/security/cve/CVE-2026-86409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86411",
"url": "https://access.redhat.com/security/cve/CVE-2026-86411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86412",
"url": "https://access.redhat.com/security/cve/CVE-2026-86412"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82895.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-17T12:55:05+00:00",
"generator": {
"date": "2026-10-17T12:55:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:82895",
"initial_release_date": "2026-10-14T11:39:33+00:00",
"revision_history": [
{
"date": "2026-10-14T11:39:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-17T01:09:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-17T12:55:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-0.1.hum1@aarch64",
"product": {
"name": "curl-0:8.23.0-0.1.hum1@aarch64",
"product_id": "curl-0:8.23.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.23.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.23.0-0.1.hum1@aarch64",
"product": {
"name": "libcurl-0:8.23.0-0.1.hum1@aarch64",
"product_id": "libcurl-0:8.23.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.23.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"product": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"product_id": "libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.23.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"product": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"product_id": "libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.23.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-0.1.hum1@s390x",
"product": {
"name": "curl-0:8.23.0-0.1.hum1@s390x",
"product_id": "curl-0:8.23.0-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.23.0-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.23.0-0.1.hum1@s390x",
"product": {
"name": "libcurl-0:8.23.0-0.1.hum1@s390x",
"product_id": "libcurl-0:8.23.0-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.23.0-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"product": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"product_id": "libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.23.0-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"product": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"product_id": "libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.23.0-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-0.1.hum1@src",
"product": {
"name": "curl-0:8.23.0-0.1.hum1@src",
"product_id": "curl-0:8.23.0-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.23.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-0.1.hum1@x86_64",
"product": {
"name": "curl-0:8.23.0-0.1.hum1@x86_64",
"product_id": "curl-0:8.23.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.23.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-0:8.23.0-0.1.hum1@x86_64",
"product": {
"name": "libcurl-0:8.23.0-0.1.hum1@x86_64",
"product_id": "libcurl-0:8.23.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl@8.23.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"product": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"product_id": "libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-devel@8.23.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@x86_64",
"product": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@x86_64",
"product_id": "libcurl-minimal-0:8.23.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libcurl-minimal@8.23.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64"
},
"product_reference": "curl-0:8.23.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x"
},
"product_reference": "curl-0:8.23.0-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src"
},
"product_reference": "curl-0:8.23.0-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64"
},
"product_reference": "curl-0:8.23.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64"
},
"product_reference": "libcurl-0:8.23.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x"
},
"product_reference": "libcurl-0:8.23.0-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64"
},
"product_reference": "libcurl-0:8.23.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64"
},
"product_reference": "libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x"
},
"product_reference": "libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64"
},
"product_reference": "libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64"
},
"product_reference": "libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x"
},
"product_reference": "libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-minimal-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
},
"product_reference": "libcurl-minimal-0:8.23.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9086",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-09-12T06:01:02.244669+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2394750"
}
],
"notes": [
{
"category": "description",
"text": "An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Curl out of bounds read for cookie path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "RHBZ#2394750",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394750"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.html",
"url": "https://curl.se/docs/CVE-2025-9086.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.json",
"url": "https://curl.se/docs/CVE-2025-9086.json"
},
{
"category": "external",
"summary": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6",
"url": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3294999",
"url": "https://hackerone.com/reports/3294999"
}
],
"release_date": "2025-09-12T05:10:03.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Curl out of bounds read for cookie path"
},
{
"cve": "CVE-2025-14017",
"cwe": {
"id": "CWE-1058",
"name": "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element"
},
"discovery_date": "2026-01-08T11:01:16.184214+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. The flaw in curl affects multi-threaded LDAPS transfers where changes to TLS options in one thread could inadvertently apply globally, impacting other concurrent transfers. This could lead to a security bypass if an application relies on specific TLS settings that are then overridden. Impact is limited to applications utilizing libcurl for multi-threaded LDAPS connections that dynamically modify TLS options.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "RHBZ#2427870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.html",
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.json",
"url": "https://curl.se/docs/CVE-2025-14017.json"
}
],
"release_date": "2026-01-08T10:07:05.554000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers"
},
{
"cve": "CVE-2025-14819",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2025-12-31T03:46:56.325000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server\u0027s security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat. `libcurl` could incorrectly reuse a cached CA store when applications alter the `CURLSSLOPT_NO_PARTIALCHAIN` option with re-used easy or multi handles. This could lead to the acceptance of an otherwise untrusted TLS trust chain. Exploitation requires specific application logic that dynamically changes this option while reusing `libcurl` handles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "RHBZ#2426408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14819.html",
"url": "https://curl.se/docs/CVE-2025-14819.html"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86409",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T12:09:28.542000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550378"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 (AWS SigV4) authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled server using the same handle, curl unintentionally transmits the signed authorization header. This flaw allows a remote attacker to obtain access key identifiers and request signatures, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: stale SigV4 headers sent unintended",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low impact because it does not affect the standard curl command-line utility and requires a highly specific programmatic workflow in applications using libcurl. Triggering the flaw requires an application to reuse transfer handles across differing trust boundaries, attempt to clear AWS SigV4 authentication by resetting the option to null, and direct subsequent requests to untrusted targets. Furthermore, the resulting exposure is restricted to the access key identifier and a request-bound signature, leaving the secret key uncompromised.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86409"
},
{
"category": "external",
"summary": "RHBZ#2550378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550378"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86409"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: stale SigV4 headers sent unintended"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86410",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-10-13T11:20:33.991000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the curl command-line tool. When configured to follow redirects to Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) destinations, curl fails to apply user-specified Secure Shell (SSH) host verification settings. A malicious server can exploit this flaw by redirecting requests to an untrusted server, causing the connection to proceed without validating the remote host\u0027s identity. This failure can enable an attacker to intercept communications, leading to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: redirect to SFTP or SCP bypasses host verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having a Low severity impact because exploitation requires an uncommon combination of non-default command-line flags and does not affect applications utilizing libcurl. Under standard configurations, curl restricts redirect targets and prevents following redirects to SSH protocols by default. A risk of omitted SSH host verification only arises when a user explicitly directs the standalone curl command-line binary to follow redirects and overrides protocol restrictions to allow SFTP or SCP.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86410"
},
{
"category": "external",
"summary": "RHBZ#2550356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86410"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86410",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86410"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: redirect to SFTP or SCP bypasses host verification"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86411",
"cwe": {
"id": "CWE-488",
"name": "Exposure of Data Element to Wrong Session"
},
"discovery_date": "2026-10-13T11:33:47.116000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550364"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol (FTP) transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security (TLS), curl fails to perform a new handshake or authentication. As a result, the subsequent transfer operates under the prior session\u0027s identity, allowing it to perform operations on the remote server with unintended authorization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: FTP connection reuse inherits client-certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low impact by Red Hat because triggering it requires an uncommon sequence of operations where a client application shares a connection pool across both certificate-authenticated FTP sessions and unauthenticated cleartext transfers. In typical enterprise environments, FTP transfers utilizing client certificate authentication are exceptionally rare, substantially constraining real-world attack scenarios. Consequently, exploitation is confined to custom applications specifically designed to reuse connection caches across transfers with mismatched security postures.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86411"
},
{
"category": "external",
"summary": "RHBZ#2550364",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550364"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86411"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: FTP connection reuse inherits client-certificate"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86412",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"discovery_date": "2026-10-13T11:50:28.033000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550374"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: server-set cookie erases cookie jar",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low severity impact because exploitation requires specific non-default invocation options and results strictly in a localized loss of session state rather than code execution or unauthorized data access. In standard Red Hat enterprise environments, curl and libcurl do not preserve HTTP state across executions by default, limiting potential exposure to custom workflows or scripts explicitly configured to maintain persistent cookie stores. Furthermore, successful exploitation requires contacting an untrusted remote endpoint that serves an oversized cookie parameter, causing the application to reset the storage file upon its subsequent run. The resulting impact is confined to session disruption without compromising host integrity or system security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86412"
},
{
"category": "external",
"summary": "RHBZ#2550374",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550374"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86412"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: server-set cookie erases cookie jar"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86413",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T14:47:07.941000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550594"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to a target URL containing embedded user credentials, resulting in information disclosure of sensitive authentication data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Negotiate credentials sent to redirected origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Low impact because successful credential exposure requires an uncommon combination of conditions: an HTTP request using Negotiate authentication with ambient Kerberos credentials must be configured to follow redirects to a secondary URL with embedded credentials. Furthermore, core Red Hat Enterprise Linux distributions ship curl versions outside the affected upstream release window. In typical enterprise environments, Kerberos-authenticated transfers rarely follow automated redirects across disparate origins, significantly limiting exposure in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86413"
},
{
"category": "external",
"summary": "RHBZ#2550594",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550594"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86413"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86413",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86413"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: Negotiate credentials sent to redirected origin"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-86414",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T09:59:04.450000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550343"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge, curl mishandles the response and transmits the origin server\u0027s credentials. This issue leads to information disclosure, allowing an untrusted proxy to intercept sensitive passwords and authentication tokens.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: leaking host credentials to HTTP proxy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low security impact because exploitation relies on routing outbound traffic through an untrusted or compromised HTTP proxy server. In standard Red Hat Enterprise Linux environments, proxy infrastructure is centrally managed within trusted network boundaries, significantly minimizing the likelihood of a rogue proxy tampering with tunnel handshakes. Furthermore, target endpoint authentication credentials are only exposed if a client actively transmits authentication data over a proxied tunnel.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86414"
},
{
"category": "external",
"summary": "RHBZ#2550343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550343"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86414",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86414"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: leaking host credentials to HTTP proxy"
},
{
"acknowledgments": [
{
"names": [
"Axel Mierczuk"
]
}
],
"cve": "CVE-2026-87861",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T15:12:25.588000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550611"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When ambient user credentials\u2014where authentication is handled implicitly without providing a username\u2014are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests intended for one server to be transmitted over an established connection to another, potentially resulting in information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: cross-origin reuse of a Negotiate connection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Low impact because exploitation requires specific preconditions involving Negotiate authentication with ambient credentials, and successful exploitation only results in limited information exposure without compromising system integrity or availability. In typical Red Hat environments, applications rarely multiplex requests across different origins while relying on blank user identities for Kerberos or SPNEGO authentication. As a result, standard enterprise deployments face minimal exposure unless custom software explicitly employs this credential handling pattern.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87861"
},
{
"category": "external",
"summary": "RHBZ#2550611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87861"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87861",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87861"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: cross-origin reuse of a Negotiate connection"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-87862",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T15:20:35.099000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When importing HTTP Strict Transport Security (HSTS) cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade subsequent connections for the subdomain to HTTPS and transmits unencrypted requests, allowing a network attacker to intercept sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: HSTS cache import drops longer-lived child",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as Low impact because exploitation depends on non-default HSTS cache usage and requires an attacker to be positioned on-path to capture unencrypted traffic once the parent rule lapses. In typical Red Hat environments, applications and administrative scripts invoke curl using explicit HTTPS URLs rather than relying on opportunistic HSTS upgrades from a shared cache file. Additionally, curl does not enable HSTS cache loading by default, substantially limiting exposure across standard deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87862"
},
{
"category": "external",
"summary": "RHBZ#2550638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87862",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87862"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: HSTS cache import drops longer-lived child"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-87863",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-10-13T15:47:55.242000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550645"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When persistent HTTP Strict Transport Security (HSTS) caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this serialization failure causes the persistent HSTS cache to be deleted or emptied. As a result, stored security policies for known hosts are lost, potentially allowing future connections to fall back to insecure communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Hsts Response Erases Persisted Entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low impact for Red Hat products because persistent HSTS caching is an opt-in feature that is not enabled by default during standard curl transfers. An untrusted HTTPS server responding with an out-of-range expiry value can cause curl to fail during serialization, resulting in an empty or truncated persistent cache file. The blast radius is limited to the loss of saved strict transport security entries between sessions and does not allow remote code execution or data compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87863"
},
{
"category": "external",
"summary": "RHBZ#2550645",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87863",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87863"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: Hsts Response Erases Persisted Entries"
},
{
"acknowledgments": [
{
"names": [
"Stanislav Fort"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-87864",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-10-13T16:03:12.849000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550666"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl is configured to perform carriage return and line feed (CRLF) conversion during an Internet Message Access Protocol (IMAP) append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the advertised length as message data, it interprets the remaining overflow bytes as subsequent commands. An attacker capable of supplying message data with line breaks can exploit this issue to execute unauthorized IMAP commands within an authenticated session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: IMAP APPEND plus CRLF conversion command injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as Low impact because exploitation demands an atypical configuration combining IMAP message uploads with explicit line-ending conversions. Furthermore, a malicious actor must have the ability to supply crafted message content within an established, authenticated mailbox session to trigger command pipelining. In standard Red Hat Enterprise Linux environments, libcurl client applications do not enable CRLF conversion by default, significantly constraining the practical attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87864"
},
{
"category": "external",
"summary": "RHBZ#2550666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550666"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87864"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: IMAP APPEND plus CRLF conversion command injection"
},
{
"acknowledgments": [
{
"names": [
"Bobbeh Rhino"
]
}
],
"cve": "CVE-2026-87865",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-13T16:11:12.826000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When libcurl is built with the libssh2 backend and uses a hashed known-hosts file, host key verification can mistakenly report a key mismatch as a missing key to custom verification callbacks. A remote attacker who intercepts or controls the Secure Shell (SSH) connection can exploit this flaw to make a previously pinned server appear as a new host. As a result, the application may inadvertently authenticate to an untrusted server, leading to credential exposure and the receipt of malicious data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: knownhost callback mismatches key as missing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is assessed as Low impact because exploitation requires a specialized non-default configuration and does not affect standard curl command-line usage. The issue is restricted to custom applications that consume libcurl compiled with libssh2 and explicitly configure a custom host key callback alongside hashed host records. Because trust-on-first-use callback logic must be custom-implemented and an attacker must be able to intercept SSH network traffic, default system installations face minimal operational risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87865"
},
{
"category": "external",
"summary": "RHBZ#2550675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87865"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87865",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87865"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: knownhost callback mismatches key as missing"
},
{
"acknowledgments": [
{
"names": [
"Muhamad Arga Reksapati"
]
}
],
"cve": "CVE-2026-87866",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-13T16:32:04.789000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550677"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the certificate and authorizing an invalid key during the Transport Layer Security (TLS) handshake.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: wolfSSL public-key pinning bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low severity because standard Red Hat distributions compile curl against OpenSSL rather than wolfSSL, significantly limiting exposure. Exploitation strictly requires applications to link against a wolfSSL-backed build of libcurl and enable pinned public key verification. Furthermore, a successful bypass relies on an attacker providing an intricately crafted certificate accepted by the underlying TLS library, leaving typical client deployments unimpacted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87866"
},
{
"category": "external",
"summary": "RHBZ#2550677",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550677"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87866"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87866",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87866"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: wolfSSL public-key pinning bypass"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92386",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550682"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl\u0027s line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: server-set cookie aborts cookie jar load",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because the impact is strictly limited to a client-side denial of service during cookie jar processing, without threatening system memory integrity or enabling code execution. In standard Red Hat environments, automated processes and CLI operations rarely persist untrusted server cookies across sessions using shared cookie files. Exploitation requires an attacker to induce the client to store an oversized cookie, and the consequence is confined to ignoring remaining entries within that particular cookie jar.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92386"
},
{
"category": "external",
"summary": "RHBZ#2550682",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550682"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92386"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92386",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92386"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: server-set cookie aborts cookie jar load"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92387",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-10-13T16:46:12.459000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550691"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts, indefinitely blocking concurrent transfers and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: never-ending loop via server response omission",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity by Red Hat because successful exploitation requires connecting to an untrusted server under specific network throughput conditions and only results in denial of service for concurrent transfers. The standard curl command-line utility is unaffected, confining the flaw to applications utilizing libcurl asynchronous multi-handles. Additionally, the issue is limited to transactions using interactive protocols such as FTP, IMAP, POP3, or SMTP where an adversarial endpoint continuously streams data without final status terminators.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92387"
},
{
"category": "external",
"summary": "RHBZ#2550691",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550691"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92387"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: never-ending loop via server response omission"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92388",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-13T16:51:39.261000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550692"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. A remote malicious server can cause a Denial of Service (DoS) or memory corruption in applications that enable File Transfer Protocol (FTP) wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the connection handle is reused or duplicated. An application that subsequently reuses or clones this corrupted handle may experience an immediate application crash or unsafe memory access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: FTP wildcard write callback mixup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Low impact because exploitation requires a specific sequence of API calls in custom applications utilizing libcurl. The issue does not affect the standard curl command-line utility and only occurs when an application explicitly enables FTP wildcard matching, which is disabled by default. Furthermore, triggering memory corruption requires a failed FTP listing followed by reuse or cloning of the affected easy handle, limiting real-world exposure across Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92388"
},
{
"category": "external",
"summary": "RHBZ#2550692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550692"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92388"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: FTP wildcard write callback mixup"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92389",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-10-13T17:12:36.649000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550700"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When handling Trivial File Transfer Protocol (TFTP) transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive data from prior operations on a reused connection handle to the attacker\u0027s server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: TFTP direction confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated with a Low severity impact for Red Hat products because exploitation depends on an unusual application architecture where a persistent library handle is reused across unrelated operations, such as an upload followed by a TFTP download from an untrusted server. The standard curl command-line utility is unaffected by this flaw. In standard enterprise deployments, TFTP usage is minimal and rarely shares connection handles with sensitive data transfers, limiting the potential blast radius to partial data exposure without enabling system modification or code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92389"
},
{
"category": "external",
"summary": "RHBZ#2550700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92389",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92389"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: TFTP direction confusion"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92390",
"cwe": {
"id": "CWE-73",
"name": "External Control of File Name or Path"
},
"discovery_date": "2026-10-13T17:19:58.033000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550702"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When the command-line tool is executed with the remote header name option to prevent overwriting existing files, a malicious server can bypass this protection by returning an intermediate HTTP 103 (Early Hints) response or through specific header ordering. This flaw allows an attacker controlling a remote server to overwrite existing local files on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: -J no-clobber guarantee bypassed with 103 early hints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because it is confined to the curl command-line utility, leaves the underlying libcurl library unaffected, and requires explicit use of non-default command arguments against an untrusted remote server. In typical Red Hat enterprise deployments, core services and applications integrate with libcurl for HTTP transfers rather than invoking the standalone CLI, significantly limiting exposure. Exploitation depends on user interaction where an administrator or script actively downloads files using the remote header naming option while handling specific server response codes like 103 Early Hints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92390"
},
{
"category": "external",
"summary": "RHBZ#2550702",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550702"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92390"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92390",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92390"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: -J no-clobber guarantee bypassed with 103 early hints"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-92391",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-10-13T17:23:12.272000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550708"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions (MIME) structures to an application utilizing the libcurl library. During memory cleanup in the curl_mime_free function, excessive recursive calls exhaust available stack memory, leading to an application crash and a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: curl_mime_free stack overflow by recursion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because triggering the crash requires an application to construct thousands of nested MIME structures via libcurl\u0027s API, an atypical pattern not encountered in normal deployments. Furthermore, the curl command-line utility is not affected, restricting the blast radius strictly to custom or third-party applications invoking these specific functions. The resulting stack exhaustion leads only to a denial of service through process termination without compromising confidentiality or integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92391"
},
{
"category": "external",
"summary": "RHBZ#2550708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550708"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92391"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: curl_mime_free stack overflow by recursion"
},
{
"acknowledgments": [
{
"names": [
"Luna with Claude"
],
"organization": "Anthropic"
}
],
"cve": "CVE-2026-92392",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-09T15:04:00.630000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2548642"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: HTTP/2 upload Use-After-Free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this flaw as having an Important severity because a malicious HTTP/2 server can remotely trigger memory corruption during data uploads, potentially leading to client application crashes or arbitrary code execution. While remote code execution has been demonstrated, exploitation requires strict prerequisites such as exact heap layout predictability and precise server-controlled timing, which limits broad automated exploitability. Earlier versions of Red Hat Enterprise Linux, including RHEL 8 and 9, are not vulnerable as they ship curl builds preceding the introduction of the flawed logic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92392"
},
{
"category": "external",
"summary": "RHBZ#2548642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92392"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
},
{
"category": "workaround",
"details": "Disable HTTP/2 in curl. For the curl CLI, use the `--http1.1` flag. For applications using libcurl, set `CURLOPT_HTTP_VERSION` to `CURL_HTTP_VERSION_1_1`. This vulnerability is only exploitable over HTTP/2 connections; HTTP/1.1 connections are not affected. Note that applications which depend on HTTP/2-specific features, such as gRPC, will not function with this workaround.",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: HTTP/2 upload Use-After-Free"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-94265",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-10-13T17:26:23.360000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550712"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitive authentication tokens, such as Kerberos tickets, to the third party. This flaw can lead to unauthorized information disclosure of user credentials across domain boundaries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Authorization: Negotiate sent to foreign origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because exploitation requires a specific, non-default combination of features, including Kerberos-based authentication and automatic redirection handling. In typical Red Hat deployments, clients only face exposure if an application or script connects to a malicious server that redirects requests to an untrusted third party using credentials embedded in the destination URL. Because curl does not follow HTTP redirects by default and Negotiate authentication is restricted to targeted enterprise workflows, the potential blast radius is limited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94265"
},
{
"category": "external",
"summary": "RHBZ#2550712",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550712"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94265"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94265",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94265"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: Authorization: Negotiate sent to foreign origin"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-94266",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2026-10-13T17:29:59.229000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550717"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file (such as a .netrc file), requesting the effective URL metadata can cause the returned destination address to improperly include those secret credentials. A local user may exploit this issue to view sensitive authentication tokens if an application or script queries and logs or displays the resolved URL.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: password leak in CURLINFO_EFFECTIVE_URL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having a Low security impact because exposure is limited to local scenarios where authentication secrets are sourced from a user configuration file and an application or script explicitly queries the effective URL metadata. Under standard configurations, curl and libcurl do not expose stored authentication tokens unless an application or script intentionally requests the resolved destination address. Exploitation requires existing local execution access alongside this specific query pattern, presenting minimal risk to typical system operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94266"
},
{
"category": "external",
"summary": "RHBZ#2550717",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550717"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94266",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94266"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: password leak in CURLINFO_EFFECTIVE_URL"
},
{
"acknowledgments": [
{
"names": [
"Luna with Claude"
],
"organization": "Anthropic"
}
],
"cve": "CVE-2026-107928",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-10-13T17:32:16.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550720"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: info leak uploading over WebSockets with GnuTLS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low impact because exploitation is constrained to curl builds utilizing the GnuTLS backend connecting to an untrusted WebSocket server, with consequences limited to an application crash or minor memory exposure. Standard curl deployments in Red Hat products typically use alternative TLS libraries such as OpenSSL, significantly reducing exposure. Furthermore, triggering this behavior requires a specific I/O blocking condition during WebSocket communication, making successful exploitation difficult to achieve in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-107928"
},
{
"category": "external",
"summary": "RHBZ#2550720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550720"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-107928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107928"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107928",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107928"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: info leak uploading over WebSockets with GnuTLS"
},
{
"acknowledgments": [
{
"names": [
"Maksim"
]
}
],
"cve": "CVE-2026-107929",
"cwe": {
"id": "CWE-488",
"name": "Exposure of Data Element to Wrong Session"
},
"discovery_date": "2026-10-13T17:34:28.489000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550721"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: local interface connection reuse mixup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because exploiting it requires an uncommon non-default configuration combining connection pooling with specific network interface binding prefixes, limiting the scope of unauthorized network traffic egress. In typical Red Hat environments, applications rarely bind transfers to dedicated local interfaces using forced interface prefixes across pooled connections. Even when triggered, the flaw only causes subsequent requests to route through a previously established source interface rather than permitting arbitrary data tampering or remote code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-107929"
},
{
"category": "external",
"summary": "RHBZ#2550721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550721"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-107929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-107929"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-107929",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107929"
}
],
"release_date": "2026-10-14T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-14T11:39:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82895"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@src",
"Red Hat Hardened Images:curl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-devel-0:8.23.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@s390x",
"Red Hat Hardened Images:libcurl-minimal-0:8.23.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: curl: local interface connection reuse mixup"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…