Moderate Security Vulnerability in curl Package: Cookie Injection and Information Disclosure
Summary
ALSA-2026:80511: Moderate: curl security update. Affects curl versions < 7.76.1-40.el9_8.8. Fixed in 7.76.1-40.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols such as HTTP, FTP, and LDAP. It is widely used in various applications for its robust functionality in handling data transfer. However, vulnerabilities in curl can expose users to security risks, making it crucial to maintain updated versions.
Vulnerability Detail
The vulnerability stems from two main issues: first, a cookie injection vulnerability that can be exploited via a malicious HTTP server using super cookies (CVE-2026-8924). This allows attackers to manipulate cookie data, potentially leading to unauthorized access or data leakage. Second, there is an information disclosure issue due to incorrect reuse of the Digest authentication header (CVE-2026-11856), which could expose sensitive information to unauthorized parties. Both vulnerabilities can have severe implications for user privacy and data security.
How To Fix
Minimum fixed version
7.76.1-40.el9_8.8
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using curl for sensitive operations until the package is updated. Additionally, consider implementing stricter server-side cookie handling and authentication mechanisms to mitigate risks.
Conclusion
The curl package has been identified with moderate security vulnerabilities that could lead to cookie injection and information disclosure. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
The vulnerabilities include cookie injection via malicious HTTP servers and information disclosure due to incorrect Digest authentication header reuse.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Super cookies are a type of tracking cookie that can persist across sessions and are often used for tracking user behavior without their consent.
If an immediate update is not possible, consider implementing stricter cookie management and authentication practices as a temporary workaround.
For detailed information, refer to the CVE pages: CVE-2026-8924 and CVE-2026-11856.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
