Skip to content
OpenAdvisories
Medium RHSA-2026:19106 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 20, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 curl 0:8.20.0-2.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl 0:8.20.0-2.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-devel 0:8.20.0-2.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-minimal 0:8.20.0-2.hum1

Vulnerabilities 2

  • Medium 5.3
    CVE-2026-7009

    OCSP stapling bypass with Apple SecTrust

    When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

    curl curl curl Alpine
  • Medium 5.3
    CVE-2026-7168

    cross-proxy Digest auth state leak

    Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Pro…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-7168
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-7009
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19106.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2476978
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-7009
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-7009
  • article
    http://www.openwall.com/lists/oss-security/2026/04/29/12
  • article
    https://curl.se/docs/CVE-2026-7009.html
  • article
    https://curl.se/docs/CVE-2026-7009.json
  • article
    https://hackerone.com/reports/3694390
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2476979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-7168
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-7168
  • article
    http://www.openwall.com/lists/oss-security/2026/04/29/14
  • article
    https://curl.se/docs/CVE-2026-7168.html
  • article
    https://curl.se/docs/CVE-2026-7168.json
  • article
    https://hackerone.com/reports/3697719