Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)
Bug Fix(es) and Enhancement(s):
* Regression of Rocky Linux-73788. The .9 revision appears to have broken the logic that forces NTLM to use HTTP/1.1. (JIRA:Rocky Linux-171912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | curl | 0:7.61.1-34.el8_10.13 |
Vulnerabilities 1
-
High 8.1
wrong STARTTLS connection reuse
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.