Critical Security Update for curl: Addressing Unauthorized Connection Reuse and Information Disclosure
Summary
ALSA-2026:69126: Important: curl security update. Affects curl versions < 7.76.1-40.el9_8.7. Fixed in 7.76.1-40.el9_8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols such as HTTP, FTP, and LDAP. It is widely used in various applications and systems due to its versatility and reliability. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in curl include unauthorized connection reuse due to a logical error (CVE-2026-8458) and information disclosure due to uncleared proxy authentication state (CVE-2026-8927). These issues could allow attackers to exploit the connection reuse mechanism to gain unauthorized access to sensitive data or to leverage the uncleared proxy authentication state to disclose private information.
How To Fix
Minimum fixed version
7.76.1-40.el9_8.7
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using proxy settings or limit the use of connection reuse in their applications until the package is updated. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The vulnerabilities in curl pose significant risks to applications that rely on this package for data transfer. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs, supporting various protocols including HTTP, FTP, and LDAP.
The risks include unauthorized access to sensitive data and potential information leakage through uncleared proxy authentication states.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
Yes, it is important to update all related packages such as curl-minimal, libcurl, libcurl-devel, and libcurl-minimal to ensure complete protection against the vulnerabilities.
If immediate updates are not possible, consider implementing workarounds such as avoiding proxy settings or limiting connection reuse until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
