[ALSA-2026:92368] Important: curl security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-10-29
Description:
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) Bug Fix(es) and Enhancement(s): * Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 libcurl-devel-7.61.1-34.el8_10.18.aarch64.rpm 1966231e8f2541a9b455c86992443f1140e772b2e331bded983b53e1db2dad83
aarch64 libcurl-7.61.1-34.el8_10.18.aarch64.rpm 9c1786febd6f0a408b00fd219bfd34f8c4723d1e8f59a5c7629204a72e4b198e
aarch64 libcurl-minimal-7.61.1-34.el8_10.18.aarch64.rpm a80ef49881574473fc88a08e1820df3937ed269e5b17986e66553500bed50bc8
aarch64 curl-7.61.1-34.el8_10.18.aarch64.rpm efb8b676e07c7d469c2afdac009588c0193e3d2dc9e624204b8dcdee59660746
i686 libcurl-7.61.1-34.el8_10.18.i686.rpm 5562d8d1d8d7858ffc62a0c544711ba3ac2c882802a81140f5f115669dbd6cfc
i686 libcurl-minimal-7.61.1-34.el8_10.18.i686.rpm 884b6bb163d1625e75d8609ad005d338cf064d09ee3d1ac2dab6df5f23e01306
i686 libcurl-devel-7.61.1-34.el8_10.18.i686.rpm b45c960143ce5c41db478af0422f49d272b70ff59779fc1776c39359a112f47e
ppc64le libcurl-7.61.1-34.el8_10.18.ppc64le.rpm 43d2cfcba1d9127a2d089ec6d35a25fed7c877a37de8e4f4a229057227a37780
ppc64le libcurl-minimal-7.61.1-34.el8_10.18.ppc64le.rpm 727efbda36e824d6db27b17ece952d474733016cca36f962f84090597b7f6f19
ppc64le curl-7.61.1-34.el8_10.18.ppc64le.rpm 90fbb7675a8b7b3966b8d2dff48b16a828e4dec06e947b396bdb1e9c8ad5d2a1
ppc64le libcurl-devel-7.61.1-34.el8_10.18.ppc64le.rpm cbdebedf17fde9eb114fabf1e8ab1cc65f08a00f7c753b5f54b7658f722e2539
s390x libcurl-7.61.1-34.el8_10.18.s390x.rpm 61d32f8b1a145369b6f9bbbfc91cbc8d079c9359a30b54ca4e08b6b8f33336d4
s390x curl-7.61.1-34.el8_10.18.s390x.rpm 6af5a4cc9bf45b8079e92df99ec4d872d2e7c41dbf7c28c624b9ae8411c0f315
s390x libcurl-minimal-7.61.1-34.el8_10.18.s390x.rpm b690c2dcf097f72a4da9cad477651d7adbc34b72c90c94fe5e1c0ff5483db715
s390x libcurl-devel-7.61.1-34.el8_10.18.s390x.rpm bf740de59c9f0c5ba6fafa27122c45b7ed9f621726a853896c533da928670a7c
x86_64 libcurl-devel-7.61.1-34.el8_10.18.x86_64.rpm 54e5a79ce4cca894f67c1fb55363df9287ad9e25c5aeb54c21e8f9e9e604e915
x86_64 libcurl-minimal-7.61.1-34.el8_10.18.x86_64.rpm 55e2cac3aa522f98adb11cdf336594920756e6afab53834c33bd03c1a025f88e
x86_64 libcurl-7.61.1-34.el8_10.18.x86_64.rpm 58af99e8392a054c6318f3954ae469f4315776af6ec0b91171ba0449f009e7d6
x86_64 curl-7.61.1-34.el8_10.18.x86_64.rpm b6d73d74cee5196645cf124c11c73770c1334f025ea0e7c29326b9486eb6a324
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.