Skip to content
OpenAdvisories
Critical RHSA-2026:80511 2 CVEs

Red Hat Security Advisory: curl security update

Published Oct 14, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-debugsource 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::appstream curl-minimal-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-devel 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::appstream libcurl-minimal-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos curl 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-debugsource 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-minimal 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos curl-minimal-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-debuginfo 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-minimal 0:7.76.1-40.el9_8.8
Red Hat · RHEL 9 enterprise_linux:9::baseos libcurl-minimal-debuginfo 0:7.76.1-40.el9_8.8

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-11856

    cross-origin Digest auth state leak

    Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8924

    trailing dot domain super cookie

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-p…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496765
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496767
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80511.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-8924
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-8924
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-8924
  • article
    https://curl.se/docs/CVE-2026-8924.html
  • article
    https://curl.se/docs/CVE-2026-8924.json
  • article
    https://hackerone.com/reports/3733905
  • report
    https://access.redhat.com/security/cve/CVE-2026-11856
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11856
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11856
  • article
    https://curl.se/docs/CVE-2026-11856.html
  • article
    https://curl.se/docs/CVE-2026-11856.json
  • article
    https://hackerone.com/reports/3793260