ELSA-2026-55432

Опубликовано: 17 авг. 2026

Источник: oracle-oval

Платформа: Oracle Linux 10

Описание

ELSA-2026-55432: curl security update (IMPORTANT)

[8.12.1-4.4]

fix proxy environment variable change detection (CVE-2026-8927)

[8.12.1-4.el10_2.3]

fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
fix proxy connection reuse with wrong credentials (CVE-2026-3784)

[8.12.1-4.2]

fix SSH host key mismatch on type difference (CVE-2026-9547)
fix schemeless URL handling with --proto-default (CVE-2026-12064)
fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

[8.12.1-4.1]

openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)

Обновленные пакеты

Oracle Linux 10

Oracle Linux aarch64

curl

8.12.1-4.el10_2.4

libcurl

8.12.1-4.el10_2.4

libcurl-devel

8.12.1-4.el10_2.4

libcurl-minimal

8.12.1-4.el10_2.4

Oracle Linux x86_64

curl

8.12.1-4.el10_2.4

libcurl

8.12.1-4.el10_2.4

libcurl-devel

8.12.1-4.el10_2.4

libcurl-minimal

8.12.1-4.el10_2.4

Связанные CVE

CVE-2026-8927

Ссылки на источники

Связанные уязвимости

CVE-2026-8927

CVSS3: 9.1

ubuntu

2 месяца назад

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.