Skip to content
OpenAdvisories
High ELSA-2026-69125 6 CVEs

Important: curl security update (Oracle Linux 10)

Published Sep 23, 2026 · Updated Sep 23, 2026

Ecosystem: Oracle Linux

Summary

[8.12.1-4.6]
- fix cookie injection via trailing dot super cookies (CVE-2026-8924)
- fix digest auth state leak on origin or credential change (CVE-2026-11856)
- fix netrc password lookup for non-matching login (CVE-2026-8926)

[8.12.1-4.5]
- fix proxy auth not cleared properly on NULL (CVE-2026-9079)
- fix incomplete mTLS config in connection reuse and session cache
(CVE-2026-8932)
- fix SASL service name connection reuse bypass (CVE-2026-8458)

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 curl 0:8.12.1-4.el10_2.6
Oracle Linux · 10 libcurl 0:8.12.1-4.el10_2.6
Oracle Linux · 10 libcurl-devel 0:8.12.1-4.el10_2.6
Oracle Linux · 10 libcurl-minimal 0:8.12.1-4.el10_2.6

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-11856

    cross-origin Digest auth state leak

    Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2026-9079

    stale proxy password leak

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8924

    trailing dot domain super cookie

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-p…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8926

    password leak with netrc and user in URL

    When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file f…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-8458

    wrong reuse for different services

    libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing c…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine