Critical Security Update for curl: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:69125: Important: curl security update. Affects curl versions < 8.12.1-4.el10_2.6. Fixed in 8.12.1-4.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and LDAP, making it essential for downloading files from servers. The libcurl library, which powers curl, is integral to many applications and services. Given its extensive use, vulnerabilities in curl can have significant implications, potentially exposing sensitive data or allowing unauthorized access.
Vulnerability Detail
The vulnerabilities in curl stem from several security flaws, including improper mTLS connection reuse, incorrect password lookups, unauthorized connection reuse, cookie injection, and information disclosure through incorrect authentication header reuse. These vulnerabilities can lead to unauthorized access, data leakage, and exploitation by malicious actors, emphasizing the need for immediate attention and remediation.
How To Fix
Minimum fixed version
8.12.1-4.el10_2.6
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using features that rely on the affected functionalities, such as disabling mTLS connection reuse or avoiding the use of .netrc files for sensitive credentials until the update is applied.
Conclusion
The vulnerabilities identified in curl and libcurl pose significant risks that require immediate attention. By updating to the latest patched versions, users can protect their systems from potential exploitation and ensure the integrity of their data transfers.
See every vulnerability recorded for curl →
FAQ
The main vulnerabilities include improper mTLS connection reuse, incorrect password lookups, unauthorized connection reuse, cookie injection, and information disclosure through incorrect authentication header reuse.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as disabling mTLS connection reuse and avoiding the use of .netrc files for sensitive credentials.
The impact includes potential unauthorized access to sensitive data, exploitation by malicious actors, and overall compromise of system security.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
