Summary
[8.12.1-4.4]
- fix proxy environment variable change detection (CVE-2026-8927)
[8.12.1-4.el10_2.3]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- fix proxy connection reuse with wrong credentials (CVE-2026-3784)
[8.12.1-4.2]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix schemeless URL handling with --proto-default (CVE-2026-12064)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)
[8.12.1-4.1]
- openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | curl | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl-devel | 0:8.12.1-4.el10_2.4 |
| Oracle Linux · 10 | libcurl-minimal | 0:8.12.1-4.el10_2.4 |
Vulnerabilities 7
-
High 8.1
wrong STARTTLS connection reuse
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
-
High 7.5
proto-default skips SSH verification
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical …
-
High 7.4
SSH improper host validation
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match…
-
Medium 6.5
bad reuse of HTTP Negotiate connection
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When …
-
Medium 6.5
wrong proxy connection reuse with credentials
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
-
Medium 5.3
OpenSSL partial chain store policy bypass
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishe…
-
Medium 5.3
token leak with redirect and netrc
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has informa…