Summary
[7.76.1-40.el9_8.7]
- add sasl service name to connection reuse checks (CVE-2026-8458)
[7.76.1-40.el9_8.6]
- detect proxy changes read from environment (CVE-2026-8927)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | curl | 0:7.76.1-40.el9_8.7 |
| Oracle Linux · 9 | curl-minimal | 0:7.76.1-40.el9_8.7 |
| Oracle Linux · 9 | libcurl | 0:7.76.1-40.el9_8.7 |
| Oracle Linux · 9 | libcurl-devel | 0:7.76.1-40.el9_8.7 |
| Oracle Linux · 9 | libcurl-minimal | 0:7.76.1-40.el9_8.7 |
Vulnerabilities 2
-
Critical 9.1
env-set cross-proxy Digest auth state leak
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…
-
Medium 6.5
wrong reuse for different services
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing c…