Skip to content
OpenAdvisories
High RLSA-2026:69125 6 CVEs

Important: curl security update

Published Sep 22, 2026 · Updated Sep 22, 2026

Ecosystem: Rocky Linux

Summary

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

* curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

* libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 curl 0:8.12.1-4.el10_2.6

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-11856

    cross-origin Digest auth state leak

    Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2026-9079

    stale proxy password leak

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8924

    trailing dot domain super cookie

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-p…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-8926

    password leak with netrc and user in URL

    When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file f…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-8458

    wrong reuse for different services

    libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing c…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496760
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496764
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496765
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496767
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2496771
  • advisory
    https://access.redhat.com/errata/RHSA-2026:69125