Red Hat Security AdvisoryRHSA-2026:80511
curl security update
Released 2026-10-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-40.el9_8.8
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-40.el9_8.8, curl-minimal-7.76.1-40.el9_8.8, libcurl-7.76.1-40.el9_8.8 +1
Fixes 2 records
Priority HIGH 82
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, mak…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00688 · Published 2026-07-03 · Partial fix · 8.14.2, 8.16.1 +1 CWE-294
Priority HIGH 80
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00661 · Published 2026-07-03 · Partial fix · 8.14.2, 8.16.1 +1 CWE-201
