Skip to content
OpenAdvisories
Medium ALAS2023-2026-3404 2 CVEs

Moderate: curl security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-19931: A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. CVE-2026-18924: A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 curl-debuginfo 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 curl-debugsource 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 curl-minimal 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 libcurl 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 libcurl-debuginfo 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 libcurl-devel 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 libcurl-minimal 0:8.21.0-5.amzn2023.0.4
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.4

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-19931

    Negotiate ambient user conn reuse

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…

    curl curl mysql curl Debian Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-18924

    HTTP/2 server push UAF

    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-18924.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-19931.html