SB20260928279 - Red Hat Enterprise Linux 10 update for curl
Published: September 28, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2025-14819)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to the way libcurl handles TLS transfers when using the CURLSSLOPT_NO_PARTIALCHAIN option. A remote attacker can trick the library into re-using a CA store cached in memory for which the partial chain option was reversed, leading to store policy bypass and a potential MitM attack.
2) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-1965)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper reuse of HTTP Negotiate connection. A remote attacker can bypass authentication and gain access to the target system.
3) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-3784)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to wrong proxy connection reuse with credentials. A remote attacker can bypass authentication and gain access to the target system.
4) Insufficiently protected credentials (CVE-ID: CVE-2026-3783)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to insufficiently protected credentials When the OAuth2 bearer token is used for an HTTP(S) transfer. A remote attacker can gain access to sensitive information on the system.
5) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-9547)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a man-in-the-middle attack.
The vulnerability exists due to improper validation of certificate with host mismatch in the CURLOPT_SSH_KEYFUNCTION callback when validating SSH host keys for SCP:// or SFTP:// transfers. A remote attacker can present a host key type that does not match the key type already recorded for the host in the known_hosts file to perform a man-in-the-middle attack.
Only libcurl-based applications built with the libssh backend and using the callback are vulnerable. The curl command line tool is not affected.
6) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-8932)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client certificate authentication.
The vulnerability exists due to authentication bypass by primary weakness in libcurl connection reuse logic when reusing a previously established connection after changing mTLS client certificate settings. A remote user can reuse a connection with mismatched client certificate configuration to bypass client certificate authentication.
The issue affects libcurl and does not affect the curl command line tool.
7) Insufficiently protected credentials (CVE-ID: CVE-2026-8926)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to use credentials intended for another user.
The vulnerability exists due to insufficiently protected credentials in .netrc credential handling when processing a URL that specifies a username without a password. A remote user can supply a URL with a username that has no matching .netrc entry to use credentials intended for another user.
This issue occurs only when curl is configured to use a .netrc file and the target host has credentials stored for a different user.
8) Improper Certificate Validation (CVE-ID: CVE-2026-8286)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS certificate validation.
The vulnerability exists due to improper certificate validation in connection reuse logic for STARTTLS-enabled protocol handling when reusing an existing live connection for a new transfer. A remote attacker can cause a transfer to reuse a connection with mismatched TLS settings to bypass TLS certificate validation.
This affects transfers using IMAP, POP3, SMTP, FTP, or LDAP schemes that begin in cleartext and are upgraded to TLS with STARTTLS.
9) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-8458)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to expose data to the wrong session.
The vulnerability exists due to exposure of data element to wrong session in libcurl connection reuse logic when reusing Negotiate-authenticated connections across different services. A remote user can issue a request that wrongfully reuses an existing authenticated connection to expose data to the wrong session.
The issue only occurs when using the same hostname, port number, and credentials, and when the previous connection remains alive in the connection pool.
10) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-8924)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie domain validation in cookie parsing logic when processing a cookie with a trailing-dot domain for a trailing-dot hostname. A remote attacker can send a specially crafted HTTP response that sets a super cookie to disclose sensitive information.
This issue is exploitable through both libcurl and the curl command line tool, and it bypasses the Public Suffix List check.
11) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-11856)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication by replaying Digest authentication state.
The vulnerability exists due to authentication bypass by capture-replay in libcurl Digest authentication handling when reusing the same handle for a second transfer to a different HTTP origin. A remote attacker can receive a request containing an Authorization header intended for another origin to bypass authentication by replaying Digest authentication state.
The issue affects libcurl but not the curl command line tool. The leaked header does not reveal the other origin, and the exposed state allows replay only for the exact path of the captured request.
12) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-12064)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to connect to an unverified SSH remote host.
The vulnerability exists due to improper validation of certificate with host mismatch in the curl command line tool when processing a schemeless URL combined with --proto-default for sftp or scp. A remote attacker can present an SSH server in that connection flow to connect to an unverified SSH remote host.
This issue affects only the curl command line tool and does not affect other users of libcurl or the libcurl library itself.
13) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-8927)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate the client to another proxy.
The vulnerability exists due to authentication bypass by capture-replay in libcurl proxy authentication state handling when reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration. A remote user can receive a leaked Proxy-Authorization header on a subsequent request to impersonate the client to another proxy.
The issue affects libcurl and does not affect the curl command line tool.
14) Insufficiently protected credentials (CVE-ID: CVE-2026-9079)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose proxy authentication credentials.
The vulnerability exists due to insufficiently protected credentials in libcurl proxy authentication handling when clearing proxy authentication credentials. A remote user can reuse a handle after changing proxy credentials to disclose proxy authentication credentials.
The issue affects libcurl and does not affect the curl command line tool.
Remediation
Install update from vendor's website.