Skip to content
OpenAdvisories
Critical RHSA-2026:82895 26 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 15, 2026 · Updated Oct 18, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 curl 0:8.23.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl 0:8.23.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-devel 0:8.23.0-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libcurl-minimal 0:8.23.0-0.1.hum1

Vulnerabilities 26

  • Critical 9.1
    CVE-2026-86411

    FTP connection reuse inherits client-certificate

    An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a ne…

    curl curl curl curl Debian Alpine
  • Critical 9.1
    CVE-2026-86413

    Negotiate credentials sent to redirected origin

    When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.

    curl curl curl curl Debian Alpine
  • Critical 9.1
    CVE-2026-86414

    leaking host credentials to HTTP proxy

    An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-87861

    cross-origin reuse of a Negotiate connection

    When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.

    curl curl curl curl Debian Alpine
  • Critical 9.1
    CVE-2026-87866

    wolfSSL public-key pinning bypass

    When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a m…

    curl curl mysql curl Debian Azure Linux Alpine
  • Critical 9.1
    CVE-2026-92388

    FTP wildcard write callback mixup

    When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-94265

    Authorization: Negotiate sent to foreign origin

    When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect con…

    curl curl curl curl Debian Alpine
  • High 8.1
    CVE-2026-107928

    info leak uploading over WebSockets with GnuTLS

    When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-107929

    local interface connection reuse mixup

    When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-86409

    stale SigV4 headers sent unintended

    Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking sta…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-86410

    redirect to SFTP or SCP bypasses host verification

    A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-86412

    server-set cookie erases cookie jar

    A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the …

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-87862

    HSTS cache import drops longer-lived child

    Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-87863

    HSTS response erases persisted entries

    An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds cale…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-87864

    IMAP APPEND plus CRLF conversion command injection

    Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted an…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-92386

    server-set cookie aborts cookie jar load

    When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cooki…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-92387

    never-ending loop via server response omission

    By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-ha…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-92389

    TFTP direction confusion

    libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that fo…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-92392 Public exploit

    HTTP/2 upload Use-After-Free

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-92390

    -J no-clobber guarantee bypassed with 103 early hints

    When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-92391

    curl_mime_free stack overflow by recursion

    A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-94266

    password leak in CURLINFO_EFFECTIVE_URL

    libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2026-87865

    knownhost callback mismatches key as missing

    When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-14017

    broken TLS options for threaded LDAPS

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-14819

    OpenSSL partial chain store policy bypass

    When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishe…

    curl curl curl curl Debian Ubuntu Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-92392
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-92388
  • report
    https://access.redhat.com/security/cve/CVE-2026-86414
  • report
    https://access.redhat.com/security/cve/CVE-2025-14017
  • report
    https://access.redhat.com/security/cve/CVE-2025-9086
  • report
    https://access.redhat.com/security/cve/CVE-2025-14819
  • report
    https://access.redhat.com/security/cve/CVE-2026-86410
  • report
    https://access.redhat.com/security/cve/CVE-2026-92389
  • report
    https://access.redhat.com/security/cve/CVE-2026-94265
  • report
    https://access.redhat.com/security/cve/CVE-2026-107928
  • report
    https://access.redhat.com/security/cve/CVE-2026-87866
  • report
    https://access.redhat.com/security/cve/CVE-2026-94266
  • report
    https://access.redhat.com/security/cve/CVE-2026-107929
  • report
    https://access.redhat.com/security/cve/CVE-2026-92386
  • report
    https://access.redhat.com/security/cve/CVE-2026-92391
  • report
    https://access.redhat.com/security/cve/CVE-2026-92390
  • report
    https://access.redhat.com/security/cve/CVE-2026-86413
  • report
    https://access.redhat.com/security/cve/CVE-2026-92387
  • report
    https://access.redhat.com/security/cve/CVE-2026-87865
  • report
    https://access.redhat.com/security/cve/CVE-2026-87863
  • report
    https://access.redhat.com/security/cve/CVE-2026-87864
  • report
    https://access.redhat.com/security/cve/CVE-2026-87862
  • report
    https://access.redhat.com/security/cve/CVE-2026-87861
  • report
    https://access.redhat.com/security/cve/CVE-2026-86409
  • report
    https://access.redhat.com/security/cve/CVE-2026-86411
  • report
    https://access.redhat.com/security/cve/CVE-2026-86412
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82895.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394750
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9086
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9086
  • article
    https://curl.se/docs/CVE-2025-9086.html
  • article
    https://curl.se/docs/CVE-2025-9086.json
  • article
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6
  • article
    https://hackerone.com/reports/3294999
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2427870
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-14017
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-14017