Skip to content
OpenAdvisories
High RLSA-2026:55432 1 CVE

Important: curl security update

Published Aug 17, 2026 · Updated Aug 17, 2026

Ecosystem: Rocky Linux

Summary

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 curl 0:8.12.1-4.el10_2.4

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-8927

    env-set cross-proxy Digest auth state leak

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496769
  • advisory
    https://access.redhat.com/errata/RHSA-2026:55432