Critical Security Update for curl: Addressing Information Disclosure Vulnerability
Summary
ALSA-2026:55432: Important: curl security update. Affects curl versions < 8.12.1-4.el10_2.4. Fixed in 8.12.1-4.el10_2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, FTP, and LDAP, making it essential for downloading files from servers. The libcurl library, which is part of the curl package, provides the functionality for these operations. However, a recent vulnerability has been identified that could lead to information disclosure due to an uncleared proxy authentication state.
Vulnerability Detail
The vulnerability, identified as CVE-2026-8927, arises from the failure to clear the proxy authentication state in curl. This oversight can allow sensitive information to be inadvertently disclosed, potentially exposing user credentials or other private data. The impact of this vulnerability is significant, as it can compromise the security of applications relying on curl for data transfers.
How To Fix
Minimum fixed version
8.12.1-4.el10_2.4
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using proxy settings in curl until the package is updated. This can be done by ensuring that the 'http_proxy' and 'https_proxy' environment variables are unset in the terminal session.
Conclusion
In summary, the curl package has a critical vulnerability (CVE-2026-8927) that can lead to information disclosure. It is crucial to update to the patched version to mitigate risks. Users can also utilize Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for curl →
FAQ
CVE-2026-8927 is a vulnerability in curl that allows for information disclosure due to an uncleared proxy authentication state.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to update curl can leave your application vulnerable to information disclosure, potentially exposing sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, consider disabling proxy settings in curl as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
