Skip to content
OpenAdvisories
High ALSA-2026:55432 1 CVE

Important: curl security update

Published Aug 17, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 10 curl 8.12.1-4.el10_2.4
AlmaLinux · 10 libcurl 8.12.1-4.el10_2.4
AlmaLinux · 10 libcurl-devel 8.12.1-4.el10_2.4
AlmaLinux · 10 libcurl-minimal 8.12.1-4.el10_2.4

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-8927

    env-set cross-proxy Digest auth state leak

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-8927
  • report
    https://bugzilla.redhat.com/2496769
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-55432.html