Moderate Security Vulnerability in curl Package: Credential Disclosure and Denial of Service Risks
Summary
ALSA-2026:80512: Moderate: curl security update. Affects curl versions < 8.12.1-4.el10_2.7. Fixed in 8.12.1-4.el10_2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols such as HTTP, FTP, and LDAP. It is widely used in many applications for its versatility and reliability in handling network communications. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities in the curl package stem from several issues, including proxy credential disclosure through redirects to unauthenticated proxies, authentication bypass due to incorrect HTTP Negotiate connection reuse, and a use-after-free vulnerability that can lead to Denial of Service. These vulnerabilities can allow attackers to gain unauthorized access to sensitive information, disrupt service availability, and exploit the system's resources.
How To Fix
Minimum fixed version
8.12.1-4.el10_2.7
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using proxy servers or ensure that all proxy connections are authenticated to mitigate the risk of credential disclosure until the package is updated.
Conclusion
In summary, the curl package has been identified with several moderate security vulnerabilities that can lead to credential disclosure and Denial of Service. It is crucial for users to update to the latest patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for curl →
FAQ
The vulnerabilities can lead to credential disclosure, unauthorized access, and Denial of Service, potentially compromising the security of applications using curl.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using authenticated proxy connections or disabling proxy usage as a temporary measure.
While specific exploits may not be publicly disclosed, the vulnerabilities present significant risks that could be exploited by attackers if not addressed.
For more details, refer to the CVE pages linked in the advisory, which provide in-depth information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
