Skip to content
OpenAdvisories
Critical RHSA-2026:63161 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 curl 0:8.22.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl 0:8.22.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-devel 0:8.22.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-minimal 0:8.22.0-0.1.hum1

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-19931

    Negotiate ambient user conn reuse

    A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated con…

    curl curl mysql curl Debian Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-18924

    HTTP/2 server push UAF

    A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2026-82209

    domain-scoped PSL domain cookie

    When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80229

    OpenSSL provider use-after-free

    When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80230

    OpenSSL pinning bypass

    When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80231

    native CA store conn reuse

    A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

    curl curl mysql curl Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80255

    secure cookie attribute bypass with tab

    A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2026-13608

    OpenLDAP SASL authentication bypass

    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-19931
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-13608
  • report
    https://access.redhat.com/security/cve/CVE-2026-18924
  • report
    https://access.redhat.com/security/cve/CVE-2026-82209
  • report
    https://access.redhat.com/security/cve/CVE-2026-80231
  • report
    https://access.redhat.com/security/cve/CVE-2026-80230
  • report
    https://access.redhat.com/security/cve/CVE-2026-80229
  • report
    https://access.redhat.com/security/cve/CVE-2026-80255
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63161.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529198
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13608
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13608
  • article
    https://curl.se/docs/CVE-2026-13608.html
  • article
    https://curl.se/docs/CVE-2026-13608.json
  • article
    https://hackerone.com/reports/3822248
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18924
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18924
  • article
    https://curl.se/docs/CVE-2026-18924.html
  • article
    https://curl.se/docs/CVE-2026-18924.json
  • article
    https://hackerone.com/reports/3916059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529199
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19931
  • article
    https://curl.se/docs/CVE-2026-19931.html
  • article
    https://curl.se/docs/CVE-2026-19931.json
  • article
    https://hackerone.com/reports/3923520
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529206
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-80229
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-80229
  • article
    https://curl.se/docs/CVE-2026-80229.html
  • article
    https://curl.se/docs/CVE-2026-80229.json
  • article
    https://hackerone.com/reports/3969255
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2529203
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-80230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-80230
  • article
    https://curl.se/docs/CVE-2026-80230.html