Summary
[8.12.1-4.4]
- fix proxy environment variable change detection (CVE-2026-8927)
[8.12.1-4.el10_2.3]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- fix proxy connection reuse with wrong credentials (CVE-2026-3784)
[8.12.1-4.2]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix schemeless URL handling with --proto-default (CVE-2026-12064)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)
[8.12.1-4.1]
- openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | curl | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl-devel | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl-minimal | 0:8.12.1-4.el10_2.4 |
Vulnerabilities 1
-
Critical 9.1
env-set cross-proxy Digest auth state leak
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…