Red Hat Security AdvisoryRHSA-2026:69126
curl security update
Released 2026-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-40.el9_8.7
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-40.el9_8.7, curl-minimal-7.76.1-40.el9_8.7, libcurl-7.76.1-40.el9_8.7 +1
Fixes 2 records
Priority HIGH 74
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.005 · Published 2026-07-03 · Partial fix · 8.14.2, 8.16.1 +1 CWE-294
Priority MEDIUM 62
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00371 · Published 2026-07-03 · Partial fix · 8.14.2, 8.16.1 +1 CWE-488
