Critical Information Disclosure Vulnerability in curl Package
Summary
RLSA-2026:55432: Important: curl security update. Affects curl versions < 0:8.12.1-4.el10_2.4. Fixed in 0:8.12.1-4.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It is widely used in various applications and systems for its versatility and reliability in handling data transfers. However, it is crucial to ensure that the package is updated to mitigate potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-8927 in the curl package allows for information disclosure due to an uncleared proxy authentication state. This means that sensitive information may be inadvertently exposed to unauthorized users if the proxy authentication state is not properly managed. The potential ramifications include unauthorized access to sensitive data, which could lead to further exploitation or data breaches.
How To Fix
Minimum fixed version
0:8.12.1-4.el10_2.4
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of proxy settings in your curl configuration until the package is updated. This can be done by setting the environment variable 'NO_PROXY=1' or by modifying your curl command to bypass the proxy.
Conclusion
The curl package is a critical component for data transfer in many applications, and the identified vulnerability CVE-2026-8927 poses a significant risk of information disclosure. It is essential to update the package to the latest version to mitigate this risk and ensure the security of your data.
See every vulnerability recorded for curl →
FAQ
CVE-2026-8927 is a vulnerability in the curl package that allows for information disclosure due to an uncleared proxy authentication state.
The vulnerability can lead to unauthorized access to sensitive information, which may result in data breaches or exploitation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
It is recommended to regularly check for updates to the curl package and apply them promptly to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
