SB2026090965 - Fedora 43 update for curl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090965

SB2026090965 - Fedora 43 update for curl

Published: September 9, 2026 Updated: September 30, 2026

Security Bulletin ID SB2026090965
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2026-10536)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in libcurl HTTP/2 stream-dependency handling when resetting and cleaning up an easy handle configured with HTTP/2 stream dependencies. A local user can invoke curl_easy_reset() and then curl_easy_cleanup() on such a handle to cause a denial of service.

The issue only affects libcurl and requires use of the rarely used HTTP/2 stream-dependency options CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E.


2) Insufficiently protected credentials (CVE-ID: CVE-2026-9079)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose proxy authentication credentials.

The vulnerability exists due to insufficiently protected credentials in libcurl proxy authentication handling when clearing proxy authentication credentials. A remote user can reuse a handle after changing proxy credentials to disclose proxy authentication credentials.

The issue affects libcurl and does not affect the curl command line tool.


3) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-8458)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to expose data to the wrong session.

The vulnerability exists due to exposure of data element to wrong session in libcurl connection reuse logic when reusing Negotiate-authenticated connections across different services. A remote user can issue a request that wrongfully reuses an existing authenticated connection to expose data to the wrong session.

The issue only occurs when using the same hostname, port number, and credentials, and when the previous connection remains alive in the connection pool.


Remediation

Install update from vendor's website.

References