SB2026101255 - Fedora 44 update for curl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101255

SB2026101255 - Fedora 44 update for curl

Published: October 12, 2026

Security Bulletin ID SB2026101255
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-8932)

CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass client certificate authentication.

The vulnerability exists due to authentication bypass by primary weakness in libcurl connection reuse logic when reusing a previously established connection after changing mTLS client certificate settings. A remote user can reuse a connection with mismatched client certificate configuration to bypass client certificate authentication.

The issue affects libcurl and does not affect the curl command line tool.


2) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2026-13608)

CWE-ID: CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass LDAP server authentication.

The vulnerability exists due to improper restriction of communication channel to intended endpoints in the libcurl SASL negotiation for LDAP authentication when processing an incomplete OpenLDAP SASL handshake sequence. A remote attacker can inject a premature or shortcut response to bypass LDAP server authentication.

The issue only occurs when the OpenLDAP backend is used, and LDAPS is not affected.


3) Improper Certificate Validation (CVE-ID: CVE-2026-80230)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass public key pinning.

The vulnerability exists due to improper certificate validation in libcurl and the curl command line tool when establishing TLS connections with CURLOPT_PINNEDPUBLICKEY configured and peer and host verification disabled. A remote attacker can present a connection without a server certificate to bypass public key pinning.

This issue is present only when curl is built with OpenSSL or a fork such as BoringSSL, AWS-LC, LibreSSL, or QuicTLS, and the insecure configuration also permits certificate-less connections.


Remediation

Install update from vendor's website.

References