THREATIST.IORead the docs Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-05-02 · Red Hat rating Moderate · View on Red Hat →
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use…
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.
curl might erroneously pass on credentials for a first proxy to a second proxy.
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool.
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.