Skip to content
OpenAdvisories
Medium ELSA-2026-92907 1 CVE

Moderate: curl security update (Oracle Linux 9)

Published Oct 29, 2026 · Updated Oct 29, 2026

Ecosystem: Oracle Linux

Summary

[7.76.1-40.el9_8.9]
- fix incomplete mTLS config in connection reuse (CVE-2026-8932)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 curl 0:7.76.1-40.el9_8.9
Oracle Linux · 9 curl-minimal 0:7.76.1-40.el9_8.9
Oracle Linux · 9 libcurl 0:7.76.1-40.el9_8.9
Oracle Linux · 9 libcurl-devel 0:7.76.1-40.el9_8.9
Oracle Linux · 9 libcurl-minimal 0:7.76.1-40.el9_8.9

Vulnerabilities 1

  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine