Red Hat Security Advisory

RHSA-2026:7432

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-04-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images curl-8.19.0-3.1.hum1@aarch64, curl-8.19.0-3.1.hum1@src, curl-8.19.0-3.1.hum1@x86_64 +6

Fixes 3 records

TI-2026-03272 CVE-2026-3783 · GHSA-8whr-249c-vfjp

token leak with redirect and netrc

MEDIUM 63

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00495 Published 2026-03-11 Partial fix · 8.14.2, 8.16.1 +1 CWE-522

TI-2026-03273 CVE-2026-3784 · GHSA-5q3w-6p3j-mw6p

wrong proxy connection reuse with credentials

LOW 35

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00448 Published 2026-03-11 Partial fix · 8.14.2, 8.16.1 +1 CWE-305

TI-2026-01624 CVE-2026-1965 · GHSA-q9qg-g2c3-3hr2

bad reuse of HTTP Negotiate connection

LOW 29

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00297 Published 2026-03-11 Partial fix · 8.14.2, 8.16.1 +1 CWE-305