Skip to content
OpenAdvisories
High RHSA-2026:57462 1 CVE

Red Hat Security Advisory: curl security, bug fix, and enhancement update

Published Aug 21, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos curl 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos curl-debuginfo 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos curl-debugsource 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos curl-minimal-debuginfo 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos libcurl 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos libcurl-debuginfo 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos libcurl-devel 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos libcurl-minimal 0:7.61.1-34.el8_10.13
Red Hat · RHEL 8 enterprise_linux:8::baseos libcurl-minimal-debuginfo 0:7.61.1-34.el8_10.13

Vulnerabilities 1

  • High 8.1
    CVE-2026-8286

    wrong STARTTLS connection reuse

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496763
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57462.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-8286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-8286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-8286
  • article
    https://curl.se/docs/CVE-2026-8286.html
  • article
    https://curl.se/docs/CVE-2026-8286.json
  • article
    https://hackerone.com/reports/3718195