Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
* curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | curl | 7.76.1-40.el9_8.7 |
| AlmaLinux · 9 | curl-minimal | 7.76.1-40.el9_8.7 |
| AlmaLinux · 9 | libcurl | 7.76.1-40.el9_8.7 |
| AlmaLinux · 9 | libcurl-devel | 7.76.1-40.el9_8.7 |
| AlmaLinux · 9 | libcurl-minimal | 7.76.1-40.el9_8.7 |
Vulnerabilities 2
-
Critical 9.1
env-set cross-proxy Digest auth state leak
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…
-
Medium 6.5
wrong reuse for different services
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing c…