Skip to content
OpenAdvisories
Medium ELSA-2026-80511 2 CVEs

Moderate: curl security update (Oracle Linux 9)

Published Oct 11, 2026 · Updated Oct 11, 2026

Ecosystem: Oracle Linux

Summary

[7.76.1-40.el9_8.8]
- fix cookie injection via trailing dot super cookies (CVE-2026-8924)
- fix digest auth state leak on origin or credential change (CVE-2026-11856)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 curl 0:7.76.1-40.el9_8.8
Oracle Linux · 9 curl-minimal 0:7.76.1-40.el9_8.8
Oracle Linux · 9 libcurl 0:7.76.1-40.el9_8.8
Oracle Linux · 9 libcurl-devel 0:7.76.1-40.el9_8.8
Oracle Linux · 9 libcurl-minimal 0:7.76.1-40.el9_8.8

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-11856

    cross-origin Digest auth state leak

    Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8924

    trailing dot domain super cookie

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-p…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine