Skip to content
OpenAdvisories
Medium ELSA-2026-1825 1 CVE

Moderate: curl security update (Oracle Linux 10)

Published Feb 3, 2026 · Updated Feb 3, 2026

Ecosystem: Oracle Linux

Summary

[8.12.1-2.el10_1.2]
- openssl: respect system crypto policy for TLS max version (RHEL-128923)

[8.12.1-2.el10_1.1]
- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
Resolves: RHEL-122689

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 curl 0:8.12.1-2.el10_1.2
Oracle Linux · 10 libcurl 0:8.12.1-2.el10_1.2
Oracle Linux · 10 libcurl-devel 0:8.12.1-2.el10_1.2
Oracle Linux · 10 libcurl-minimal 0:8.12.1-2.el10_1.2

Vulnerabilities 1

  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine