Vulnerability-Lookup

CVE-2026-8286 (GCVE-0-2026-8286)

Vulnerability from cvelistv5 – Published: 2026-07-03 06:14 – Updated: 2026-07-06 17:33

Title

wrong STARTTLS connection reuse

Summary

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 17:33 UTC

CWE

CWE-295 Improper Certificate Validation

Assigner

curl redhat root

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-8286.json
https://curl.se/docs/CVE-2026-8286.html
https://hackerone.com/reports/3718195

Impacted products

1 product

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.20.0 , ≤ 8.20.0 (semver) Affected: 8.19.0 , ≤ 8.19.0 (semver) Affected: 8.18.0 , ≤ 8.18.0 (semver) Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver) Affected: 7.68.0 , ≤ 7.68.0 (semver) Affected: 7.67.0 , ≤ 7.67.0 (semver) Affected: 7.66.0 , ≤ 7.66.0 (semver) Affected: 7.65.3 , ≤ 7.65.3 (semver) Affected: 7.65.2 , ≤ 7.65.2 (semver) Affected: 7.65.1 , ≤ 7.65.1 (semver) Affected: 7.65.0 , ≤ 7.65.0 (semver) Affected: 7.64.1 , ≤ 7.64.1 (semver) Affected: 7.64.0 , ≤ 7.64.0 (semver) Affected: 7.63.0 , ≤ 7.63.0 (semver) Affected: 7.62.0 , ≤ 7.62.0 (semver) Affected: 7.61.1 , ≤ 7.61.1 (semver) Affected: 7.61.0 , ≤ 7.61.0 (semver) Affected: 7.60.0 , ≤ 7.60.0 (semver) Affected: 7.59.0 , ≤ 7.59.0 (semver) Affected: 7.58.0 , ≤ 7.58.0 (semver) Affected: 7.57.0 , ≤ 7.57.0 (semver) Affected: 7.56.1 , ≤ 7.56.1 (semver) Affected: 7.56.0 , ≤ 7.56.0 (semver) Affected: 7.55.1 , ≤ 7.55.1 (semver) Affected: 7.55.0 , ≤ 7.55.0 (semver) Affected: 7.54.1 , ≤ 7.54.1 (semver) Affected: 7.54.0 , ≤ 7.54.0 (semver) Affected: 7.53.1 , ≤ 7.53.1 (semver) Affected: 7.53.0 , ≤ 7.53.0 (semver) Affected: 7.52.1 , ≤ 7.52.1 (semver) Affected: 7.52.0 , ≤ 7.52.0 (semver) Affected: 7.51.0 , ≤ 7.51.0 (semver) Affected: 7.50.3 , ≤ 7.50.3 (semver) Affected: 7.50.2 , ≤ 7.50.2 (semver) Affected: 7.50.1 , ≤ 7.50.1 (semver) Affected: 7.50.0 , ≤ 7.50.0 (semver) Affected: 7.49.1 , ≤ 7.49.1 (semver) Affected: 7.49.0 , ≤ 7.49.0 (semver) Affected: 7.48.0 , ≤ 7.48.0 (semver) Affected: 7.47.1 , ≤ 7.47.1 (semver) Affected: 7.47.0 , ≤ 7.47.0 (semver) Affected: 7.46.0 , ≤ 7.46.0 (semver) Affected: 7.45.0 , ≤ 7.45.0 (semver) Affected: 7.44.0 , ≤ 7.44.0 (semver) Affected: 7.43.0 , ≤ 7.43.0 (semver) Affected: 7.42.1 , ≤ 7.42.1 (semver) Affected: 7.42.0 , ≤ 7.42.0 (semver) Affected: 7.41.0 , ≤ 7.41.0 (semver) Affected: 7.40.0 , ≤ 7.40.0 (semver) Affected: 7.39.0 , ≤ 7.39.0 (semver) Affected: 7.38.0 , ≤ 7.38.0 (semver) Affected: 7.37.1 , ≤ 7.37.1 (semver) Affected: 7.37.0 , ≤ 7.37.0 (semver) Affected: 7.36.0 , ≤ 7.36.0 (semver) Affected: 7.35.0 , ≤ 7.35.0 (semver) Affected: 7.34.0 , ≤ 7.34.0 (semver) Affected: 7.33.0 , ≤ 7.33.0 (semver) Affected: 7.32.0 , ≤ 7.32.0 (semver) Affected: 7.31.0 , ≤ 7.31.0 (semver) Affected: 7.30.0 , ≤ 7.30.0 (semver)	guessed

Credits

Andrew Nesbitt (powered by Mythos) Stefan Eissing

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8286",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T17:33:16.174641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T17:33:50.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3718195"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.68.0",
              "status": "affected",
              "version": "7.68.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.67.0",
              "status": "affected",
              "version": "7.67.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.66.0",
              "status": "affected",
              "version": "7.66.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.3",
              "status": "affected",
              "version": "7.65.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.2",
              "status": "affected",
              "version": "7.65.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.1",
              "status": "affected",
              "version": "7.65.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.0",
              "status": "affected",
              "version": "7.65.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.1",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.0",
              "status": "affected",
              "version": "7.64.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.63.0",
              "status": "affected",
              "version": "7.63.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.62.0",
              "status": "affected",
              "version": "7.62.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.1",
              "status": "affected",
              "version": "7.61.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.0",
              "status": "affected",
              "version": "7.61.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.60.0",
              "status": "affected",
              "version": "7.60.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.59.0",
              "status": "affected",
              "version": "7.59.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.58.0",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.57.0",
              "status": "affected",
              "version": "7.57.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.1",
              "status": "affected",
              "version": "7.56.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.0",
              "status": "affected",
              "version": "7.56.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.1",
              "status": "affected",
              "version": "7.55.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.0",
              "status": "affected",
              "version": "7.55.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.1",
              "status": "affected",
              "version": "7.54.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.0",
              "status": "affected",
              "version": "7.54.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.1",
              "status": "affected",
              "version": "7.53.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.0",
              "status": "affected",
              "version": "7.53.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.1",
              "status": "affected",
              "version": "7.52.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.0",
              "status": "affected",
              "version": "7.52.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.51.0",
              "status": "affected",
              "version": "7.51.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.3",
              "status": "affected",
              "version": "7.50.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.2",
              "status": "affected",
              "version": "7.50.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.1",
              "status": "affected",
              "version": "7.50.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.0",
              "status": "affected",
              "version": "7.50.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.1",
              "status": "affected",
              "version": "7.49.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.0",
              "status": "affected",
              "version": "7.49.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.48.0",
              "status": "affected",
              "version": "7.48.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.1",
              "status": "affected",
              "version": "7.47.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.0",
              "status": "affected",
              "version": "7.47.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.46.0",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.45.0",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.44.0",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.43.0",
              "status": "affected",
              "version": "7.43.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.1",
              "status": "affected",
              "version": "7.42.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.0",
              "status": "affected",
              "version": "7.42.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.41.0",
              "status": "affected",
              "version": "7.41.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.40.0",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.39.0",
              "status": "affected",
              "version": "7.39.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.38.0",
              "status": "affected",
              "version": "7.38.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.1",
              "status": "affected",
              "version": "7.37.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.0",
              "status": "affected",
              "version": "7.37.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.36.0",
              "status": "affected",
              "version": "7.36.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.35.0",
              "status": "affected",
              "version": "7.35.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.34.0",
              "status": "affected",
              "version": "7.34.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.33.0",
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.32.0",
              "status": "affected",
              "version": "7.32.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.31.0",
              "status": "affected",
              "version": "7.31.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.30.0",
              "status": "affected",
              "version": "7.30.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrew Nesbitt (powered by Mythos)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stefan Eissing"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-03T06:14:17.541Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2026-8286.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2026-8286.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/3718195"
        }
      ],
      "title": "wrong STARTTLS connection reuse"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-8286",
    "datePublished": "2026-07-03T06:14:17.541Z",
    "dateReserved": "2026-05-11T07:06:37.906Z",
    "dateUpdated": "2026-07-06T17:33:50.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-8286",
      "date": "2026-08-20",
      "epss": "0.00309",
      "percentile": "0.23748"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:02:53.000Z",
      "cve": "CVE-2026-8286",
      "id": "msrc_CVE-2026-8286",
      "initial_release_date": "2026-07-04T01:06:52.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wrong STARTTLS connection reuse",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-8286.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-8286\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2026-07-03T07:16:24.453\",\"lastModified\":\"2026-07-07T19:42:11.240\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\\nconnection might reuse an existing live connection even though the TLS\\nconfiguration mismatches so it should not.\"}],\"affected\":[{\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"affectedData\":[{\"vendor\":\"curl\",\"product\":\"curl\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.20.0\",\"lessThanOrEqual\":\"8.20.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.19.0\",\"lessThanOrEqual\":\"8.19.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.18.0\",\"lessThanOrEqual\":\"8.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.17.0\",\"lessThanOrEqual\":\"8.17.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.16.0\",\"lessThanOrEqual\":\"8.16.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.15.0\",\"lessThanOrEqual\":\"8.15.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.14.1\",\"lessThanOrEqual\":\"8.14.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.14.0\",\"lessThanOrEqual\":\"8.14.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.13.0\",\"lessThanOrEqual\":\"8.13.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.12.1\",\"lessThanOrEqual\":\"8.12.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.12.0\",\"lessThanOrEqual\":\"8.12.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.11.1\",\"lessThanOrEqual\":\"8.11.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.11.0\",\"lessThanOrEqual\":\"8.11.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.10.1\",\"lessThanOrEqual\":\"8.10.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.10.0\",\"lessThanOrEqual\":\"8.10.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.9.1\",\"lessThanOrEqual\":\"8.9.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.9.0\",\"lessThanOrEqual\":\"8.9.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.8.0\",\"lessThanOrEqual\":\"8.8.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.7.1\",\"lessThanOrEqual\":\"8.7.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.7.0\",\"lessThanOrEqual\":\"8.7.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.6.0\",\"lessThanOrEqual\":\"8.6.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.5.0\",\"lessThanOrEqual\":\"8.5.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.4.0\",\"lessThanOrEqual\":\"8.4.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.3.0\",\"lessThanOrEqual\":\"8.3.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.2.1\",\"lessThanOrEqual\":\"8.2.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.2.0\",\"lessThanOrEqual\":\"8.2.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.1.2\",\"lessThanOrEqual\":\"8.1.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.1.1\",\"lessThanOrEqual\":\"8.1.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.1.0\",\"lessThanOrEqual\":\"8.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.0.1\",\"lessThanOrEqual\":\"8.0.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.0.0\",\"lessThanOrEqual\":\"8.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.88.1\",\"lessThanOrEqual\":\"7.88.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.88.0\",\"lessThanOrEqual\":\"7.88.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.87.0\",\"lessThanOrEqual\":\"7.87.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.86.0\",\"lessThanOrEqual\":\"7.86.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.85.0\",\"lessThanOrEqual\":\"7.85.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.84.0\",\"lessThanOrEqual\":\"7.84.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.83.1\",\"lessThanOrEqual\":\"7.83.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.83.0\",\"lessThanOrEqual\":\"7.83.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.82.0\",\"lessThanOrEqual\":\"7.82.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.81.0\",\"lessThanOrEqual\":\"7.81.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.80.0\",\"lessThanOrEqual\":\"7.80.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.79.1\",\"lessThanOrEqual\":\"7.79.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.79.0\",\"lessThanOrEqual\":\"7.79.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.78.0\",\"lessThanOrEqual\":\"7.78.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.77.0\",\"lessThanOrEqual\":\"7.77.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.76.1\",\"lessThanOrEqual\":\"7.76.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.76.0\",\"lessThanOrEqual\":\"7.76.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.75.0\",\"lessThanOrEqual\":\"7.75.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.74.0\",\"lessThanOrEqual\":\"7.74.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.73.0\",\"lessThanOrEqual\":\"7.73.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.72.0\",\"lessThanOrEqual\":\"7.72.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.71.1\",\"lessThanOrEqual\":\"7.71.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.71.0\",\"lessThanOrEqual\":\"7.71.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.70.0\",\"lessThanOrEqual\":\"7.70.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.69.1\",\"lessThanOrEqual\":\"7.69.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.69.0\",\"lessThanOrEqual\":\"7.69.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.68.0\",\"lessThanOrEqual\":\"7.68.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.67.0\",\"lessThanOrEqual\":\"7.67.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.66.0\",\"lessThanOrEqual\":\"7.66.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.65.3\",\"lessThanOrEqual\":\"7.65.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.65.2\",\"lessThanOrEqual\":\"7.65.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.65.1\",\"lessThanOrEqual\":\"7.65.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.65.0\",\"lessThanOrEqual\":\"7.65.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.64.1\",\"lessThanOrEqual\":\"7.64.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.64.0\",\"lessThanOrEqual\":\"7.64.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.63.0\",\"lessThanOrEqual\":\"7.63.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.62.0\",\"lessThanOrEqual\":\"7.62.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.61.1\",\"lessThanOrEqual\":\"7.61.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.61.0\",\"lessThanOrEqual\":\"7.61.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.60.0\",\"lessThanOrEqual\":\"7.60.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.59.0\",\"lessThanOrEqual\":\"7.59.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.58.0\",\"lessThanOrEqual\":\"7.58.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.57.0\",\"lessThanOrEqual\":\"7.57.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.56.1\",\"lessThanOrEqual\":\"7.56.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.56.0\",\"lessThanOrEqual\":\"7.56.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.55.1\",\"lessThanOrEqual\":\"7.55.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.55.0\",\"lessThanOrEqual\":\"7.55.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.54.1\",\"lessThanOrEqual\":\"7.54.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.54.0\",\"lessThanOrEqual\":\"7.54.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.53.1\",\"lessThanOrEqual\":\"7.53.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.53.0\",\"lessThanOrEqual\":\"7.53.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.52.1\",\"lessThanOrEqual\":\"7.52.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.52.0\",\"lessThanOrEqual\":\"7.52.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.51.0\",\"lessThanOrEqual\":\"7.51.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.50.3\",\"lessThanOrEqual\":\"7.50.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.50.2\",\"lessThanOrEqual\":\"7.50.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.50.1\",\"lessThanOrEqual\":\"7.50.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.50.0\",\"lessThanOrEqual\":\"7.50.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.49.1\",\"lessThanOrEqual\":\"7.49.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.49.0\",\"lessThanOrEqual\":\"7.49.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.48.0\",\"lessThanOrEqual\":\"7.48.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.47.1\",\"lessThanOrEqual\":\"7.47.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.47.0\",\"lessThanOrEqual\":\"7.47.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.46.0\",\"lessThanOrEqual\":\"7.46.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.45.0\",\"lessThanOrEqual\":\"7.45.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.44.0\",\"lessThanOrEqual\":\"7.44.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.43.0\",\"lessThanOrEqual\":\"7.43.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.42.1\",\"lessThanOrEqual\":\"7.42.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.42.0\",\"lessThanOrEqual\":\"7.42.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.41.0\",\"lessThanOrEqual\":\"7.41.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.40.0\",\"lessThanOrEqual\":\"7.40.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.39.0\",\"lessThanOrEqual\":\"7.39.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.38.0\",\"lessThanOrEqual\":\"7.38.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.37.1\",\"lessThanOrEqual\":\"7.37.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.37.0\",\"lessThanOrEqual\":\"7.37.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.36.0\",\"lessThanOrEqual\":\"7.36.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.35.0\",\"lessThanOrEqual\":\"7.35.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.34.0\",\"lessThanOrEqual\":\"7.34.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.33.0\",\"lessThanOrEqual\":\"7.33.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.32.0\",\"lessThanOrEqual\":\"7.32.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.31.0\",\"lessThanOrEqual\":\"7.31.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.30.0\",\"lessThanOrEqual\":\"7.30.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-06T17:33:16.174641Z\",\"id\":\"CVE-2026-8286\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.30.0\",\"versionEndExcluding\":\"8.21.0\",\"matchCriteriaId\":\"248C6E85-F6A2-4E75-8D49-D00FEB938FAE\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2026-8286.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://curl.se/docs/CVE-2026-8286.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/3718195\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://hackerone.com/reports/3718195\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T14:26:35+00:00",
      "cve": "CVE-2026-8286",
      "id": "CVE-2026-8286",
      "initial_release_date": "2026-07-03T06:14:17.541000+00:00",
      "product_status:fixed": "175",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8286.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-18T00:19:04Z",
      "cve": "CVE-2026-8286",
      "id": "CVE-2026-8286",
      "initial_release_date": "2026-07-10T03:20:32Z",
      "product_status:first_fixed": "13",
      "product_status:known_affected": "448",
      "product_status:known_not_affected": "13",
      "product_status:recommended": "131",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-8286",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-8286.json",
      "version": "9"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-8286\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-06T17:33:16.174641Z\"}}}], \"references\": [{\"url\": \"https://hackerone.com/reports/3718195\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-06T17:33:45.469Z\"}}], \"cna\": {\"title\": \"wrong STARTTLS connection reuse\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Andrew Nesbitt (powered by Mythos)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Stefan Eissing\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.20.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.20.0\"}, {\"status\": \"affected\", \"version\": \"8.19.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.19.0\"}, {\"status\": \"affected\", \"version\": \"8.18.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.18.0\"}, {\"status\": \"affected\", \"version\": \"8.17.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.17.0\"}, {\"status\": \"affected\", \"version\": \"8.16.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.16.0\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.0\"}, {\"status\": \"affected\", \"version\": \"8.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.74.0\"}, {\"status\": \"affected\", \"version\": \"7.73.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.73.0\"}, {\"status\": \"affected\", \"version\": \"7.72.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.72.0\"}, {\"status\": \"affected\", \"version\": \"7.71.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.1\"}, {\"status\": \"affected\", \"version\": \"7.71.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.0\"}, {\"status\": \"affected\", \"version\": \"7.70.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.70.0\"}, {\"status\": \"affected\", \"version\": \"7.69.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.1\"}, {\"status\": \"affected\", \"version\": \"7.69.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.0\"}, {\"status\": \"affected\", \"version\": \"7.68.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.68.0\"}, {\"status\": \"affected\", \"version\": \"7.67.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.67.0\"}, {\"status\": \"affected\", \"version\": \"7.66.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.66.0\"}, {\"status\": \"affected\", \"version\": \"7.65.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.3\"}, {\"status\": \"affected\", \"version\": \"7.65.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.2\"}, {\"status\": \"affected\", \"version\": \"7.65.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.1\"}, {\"status\": \"affected\", \"version\": \"7.65.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.0\"}, {\"status\": \"affected\", \"version\": \"7.64.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.1\"}, {\"status\": \"affected\", \"version\": \"7.64.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.0\"}, {\"status\": \"affected\", \"version\": \"7.63.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.63.0\"}, {\"status\": \"affected\", \"version\": \"7.62.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.62.0\"}, {\"status\": \"affected\", \"version\": \"7.61.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.1\"}, {\"status\": \"affected\", \"version\": \"7.61.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.0\"}, {\"status\": \"affected\", \"version\": \"7.60.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.60.0\"}, {\"status\": \"affected\", \"version\": \"7.59.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.59.0\"}, {\"status\": \"affected\", \"version\": \"7.58.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.58.0\"}, {\"status\": \"affected\", \"version\": \"7.57.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.57.0\"}, {\"status\": \"affected\", \"version\": \"7.56.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.1\"}, {\"status\": \"affected\", \"version\": \"7.56.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.0\"}, {\"status\": \"affected\", \"version\": \"7.55.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.1\"}, {\"status\": \"affected\", \"version\": \"7.55.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.0\"}, {\"status\": \"affected\", \"version\": \"7.54.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.1\"}, {\"status\": \"affected\", \"version\": \"7.54.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.0\"}, {\"status\": \"affected\", \"version\": \"7.53.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.1\"}, {\"status\": \"affected\", \"version\": \"7.53.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.0\"}, {\"status\": \"affected\", \"version\": \"7.52.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.1\"}, {\"status\": \"affected\", \"version\": \"7.52.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.0\"}, {\"status\": \"affected\", \"version\": \"7.51.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.51.0\"}, {\"status\": \"affected\", \"version\": \"7.50.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.3\"}, {\"status\": \"affected\", \"version\": \"7.50.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.2\"}, {\"status\": \"affected\", \"version\": \"7.50.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.1\"}, {\"status\": \"affected\", \"version\": \"7.50.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.0\"}, {\"status\": \"affected\", \"version\": \"7.49.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.1\"}, {\"status\": \"affected\", \"version\": \"7.49.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.0\"}, {\"status\": \"affected\", \"version\": \"7.48.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.48.0\"}, {\"status\": \"affected\", \"version\": \"7.47.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.1\"}, {\"status\": \"affected\", \"version\": \"7.47.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.0\"}, {\"status\": \"affected\", \"version\": \"7.46.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.46.0\"}, {\"status\": \"affected\", \"version\": \"7.45.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.45.0\"}, {\"status\": \"affected\", \"version\": \"7.44.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.44.0\"}, {\"status\": \"affected\", \"version\": \"7.43.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.43.0\"}, {\"status\": \"affected\", \"version\": \"7.42.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.1\"}, {\"status\": \"affected\", \"version\": \"7.42.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.0\"}, {\"status\": \"affected\", \"version\": \"7.41.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.41.0\"}, {\"status\": \"affected\", \"version\": \"7.40.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.40.0\"}, {\"status\": \"affected\", \"version\": \"7.39.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.39.0\"}, {\"status\": \"affected\", \"version\": \"7.38.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.38.0\"}, {\"status\": \"affected\", \"version\": \"7.37.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.1\"}, {\"status\": \"affected\", \"version\": \"7.37.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.0\"}, {\"status\": \"affected\", \"version\": \"7.36.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.36.0\"}, {\"status\": \"affected\", \"version\": \"7.35.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.35.0\"}, {\"status\": \"affected\", \"version\": \"7.34.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.34.0\"}, {\"status\": \"affected\", \"version\": \"7.33.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.33.0\"}, {\"status\": \"affected\", \"version\": \"7.32.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.32.0\"}, {\"status\": \"affected\", \"version\": \"7.31.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.31.0\"}, {\"status\": \"affected\", \"version\": \"7.30.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.30.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2026-8286.json\", \"name\": \"json\"}, {\"url\": \"https://curl.se/docs/CVE-2026-8286.html\", \"name\": \"www\"}, {\"url\": \"https://hackerone.com/reports/3718195\", \"name\": \"issue\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\\nconnection might reuse an existing live connection even though the TLS\\nconfiguration mismatches so it should not.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-07-03T06:14:17.541Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-8286\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-06T17:33:50.416Z\", \"dateReserved\": \"2026-05-11T07:06:37.906Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2026-07-03T06:14:17.541Z\", \"assignerShortName\": \"curl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2026:55450

Vulnerability from csaf_redhat - Published: 2026-08-17 05:15 - Updated: 2026-08-20 20:45

Summary

Red Hat Security Advisory: curl security update

Severity

Important

Notes

Topic: An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819) * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965) * curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784) * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783) * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547) * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286) * curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-14819

A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2026-1965

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-3783

A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-3784

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-8286

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-9547

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-12064

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP (SSH File Transfer Protocol) or SCP (Secure Copy Protocol) as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect to an unverified SSH remote host without alerting the user. This could enable an attacker to intercept or manipulate data through a man-in-the-middle attack.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 49 products

Product	Version	Remediation
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

58 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:55450	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2426408	external
https://bugzilla.redhat.com/show_bug.cgi?id=2446448	external
https://bugzilla.redhat.com/show_bug.cgi?id=2446449	external
https://bugzilla.redhat.com/show_bug.cgi?id=2446450	external
https://bugzilla.redhat.com/show_bug.cgi?id=2496758	external
https://bugzilla.redhat.com/show_bug.cgi?id=2496763	external
https://bugzilla.redhat.com/show_bug.cgi?id=2496768	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-14819	self
https://bugzilla.redhat.com/show_bug.cgi?id=2426408	external
https://www.cve.org/CVERecord?id=CVE-2025-14819	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14819	external
https://curl.se/docs/CVE-2025-14819.html	external
https://access.redhat.com/security/cve/CVE-2026-1965	self
https://bugzilla.redhat.com/show_bug.cgi?id=2446448	external
https://www.cve.org/CVERecord?id=CVE-2026-1965	external
https://nvd.nist.gov/vuln/detail/CVE-2026-1965	external
https://curl.se/docs/CVE-2026-1965.html	external
https://curl.se/docs/CVE-2026-1965.json	external
https://access.redhat.com/security/cve/CVE-2026-3783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2446450	external
https://www.cve.org/CVERecord?id=CVE-2026-3783	external
https://nvd.nist.gov/vuln/detail/CVE-2026-3783	external
http://www.openwall.com/lists/oss-security/2026/03/11/2	external
https://curl.se/docs/CVE-2026-3783.html	external
https://curl.se/docs/CVE-2026-3783.json	external
https://hackerone.com/reports/3583983	external
https://access.redhat.com/security/cve/CVE-2026-3784	self
https://bugzilla.redhat.com/show_bug.cgi?id=2446449	external
https://www.cve.org/CVERecord?id=CVE-2026-3784	external
https://nvd.nist.gov/vuln/detail/CVE-2026-3784	external
http://www.openwall.com/lists/oss-security/2026/03/11/3	external
https://curl.se/docs/CVE-2026-3784.html	external
https://curl.se/docs/CVE-2026-3784.json	external
https://hackerone.com/reports/3584903	external
https://access.redhat.com/security/cve/CVE-2026-8286	self
https://bugzilla.redhat.com/show_bug.cgi?id=2496763	external
https://www.cve.org/CVERecord?id=CVE-2026-8286	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8286	external
https://curl.se/docs/CVE-2026-8286.html	external
https://curl.se/docs/CVE-2026-8286.json	external
https://hackerone.com/reports/3718195	external
https://access.redhat.com/security/cve/CVE-2026-9547	self
https://bugzilla.redhat.com/show_bug.cgi?id=2496758	external
https://www.cve.org/CVERecord?id=CVE-2026-9547	external
https://nvd.nist.gov/vuln/detail/CVE-2026-9547	external
https://curl.se/docs/CVE-2026-9547.html	external
https://curl.se/docs/CVE-2026-9547.json	external
https://hackerone.com/reports/3751712	external
https://access.redhat.com/security/cve/CVE-2026-12064	self
https://bugzilla.redhat.com/show_bug.cgi?id=2496768	external
https://www.cve.org/CVERecord?id=CVE-2026-12064	external
https://nvd.nist.gov/vuln/detail/CVE-2026-12064	external
https://curl.se/docs/CVE-2026-12064.html	external
https://curl.se/docs/CVE-2026-12064.json	external
https://hackerone.com/reports/3797526	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for curl is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819)\n\n* curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965)\n\n* curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784)\n\n* curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783)\n\n* curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)\n\n* curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)\n\n* curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:55450",
        "url": "https://access.redhat.com/errata/RHSA-2026:55450"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2426408",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426408"
      },
      {
        "category": "external",
        "summary": "2446448",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
      },
      {
        "category": "external",
        "summary": "2446449",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446449"
      },
      {
        "category": "external",
        "summary": "2446450",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
      },
      {
        "category": "external",
        "summary": "2496758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
      },
      {
        "category": "external",
        "summary": "2496763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
      },
      {
        "category": "external",
        "summary": "2496768",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496768"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55450.json"
      }
    ],
    "title": "Red Hat Security Advisory: curl security update",
    "tracking": {
      "current_release_date": "2026-08-20T20:45:18+00:00",
      "generator": {
        "date": "2026-08-20T20:45:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:55450",
      "initial_release_date": "2026-08-17T05:15:25+00:00",
      "revision_history": [
        {
          "date": "2026-08-17T05:15:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-17T05:15:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-20T20:45:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 10)",
                  "product_id": "BaseOS-10.2.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "curl-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "curl-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.3?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "curl-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "curl-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "libcurl-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "libcurl-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
                "product": {
                  "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
                  "product_id": "libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@8.12.1-4.el10_2.3?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:8.12.1-4.el10_2.3.src",
                "product": {
                  "name": "curl-0:8.12.1-4.el10_2.3.src",
                  "product_id": "curl-0:8.12.1-4.el10_2.3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@8.12.1-4.el10_2.3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "AppStream-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.3.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.3.src",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "curl-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
          "product_id": "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
        "relates_to_product_reference": "BaseOS-10.2.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14819",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2025-12-31T03:46:56.325000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2426408"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server\u0027s security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat. `libcurl` could incorrectly reuse a cached CA store when applications alter the `CURLSSLOPT_NO_PARTIALCHAIN` option with re-used easy or multi handles. This could lead to the acceptance of an otherwise untrusted TLS trust chain. Exploitation requires specific application logic that dynamically changes this option while reusing `libcurl` handles.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2426408",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426408"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2025-14819.html",
          "url": "https://curl.se/docs/CVE-2025-14819.html"
        }
      ],
      "release_date": "2026-01-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse"
    },
    {
      "cve": "CVE-2026-1965",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-03-11T11:00:54.752485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446448"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446448",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-1965.html",
          "url": "https://curl.se/docs/CVE-2026-1965.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-1965.json",
          "url": "https://curl.se/docs/CVE-2026-1965.json"
        }
      ],
      "release_date": "2026-03-11T10:08:52.431000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication"
    },
    {
      "cve": "CVE-2026-3783",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-03-11T11:01:01.429907+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446450"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446450",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/03/11/2",
          "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-3783.html",
          "url": "https://curl.se/docs/CVE-2026-3783.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-3783.json",
          "url": "https://curl.se/docs/CVE-2026-3783.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3583983",
          "url": "https://hackerone.com/reports/3583983"
        }
      ],
      "release_date": "2026-03-11T10:09:08.746000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect"
    },
    {
      "cve": "CVE-2026-3784",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-03-11T11:00:57.752827+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446449"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446449",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446449"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/03/11/3",
          "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-3784.html",
          "url": "https://curl.se/docs/CVE-2026-3784.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-3784.json",
          "url": "https://curl.se/docs/CVE-2026-3784.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3584903",
          "url": "https://hackerone.com/reports/3584903"
        }
      ],
      "release_date": "2026-03-11T10:09:21.418000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse"
    },
    {
      "cve": "CVE-2026-8286",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-07-03T07:01:27.043110+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8286.html",
          "url": "https://curl.se/docs/CVE-2026-8286.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8286.json",
          "url": "https://curl.se/docs/CVE-2026-8286.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3718195",
          "url": "https://hackerone.com/reports/3718195"
        }
      ],
      "release_date": "2026-07-03T06:14:17.541000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    },
    {
      "cve": "CVE-2026-9547",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-07-03T07:01:12.182841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496758"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server\u0027s host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Man-in-the-middle attack via SSH host key bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw where libcurl-based applications performing SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the one recorded in the known_hosts file, bypassing a critical host key verification and enabling potential man-in-the-middle attacks. The vulnerability requires specific application callback usage, not a general curl client default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9547"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496758",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9547",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-9547.html",
          "url": "https://curl.se/docs/CVE-2026-9547.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-9547.json",
          "url": "https://curl.se/docs/CVE-2026-9547.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3751712",
          "url": "https://hackerone.com/reports/3751712"
        }
      ],
      "release_date": "2026-07-03T06:18:44.499000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "curl: curl: Man-in-the-middle attack via SSH host key bypass"
    },
    {
      "cve": "CVE-2026-12064",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-03T07:01:41.779195+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496768"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP (SSH File Transfer Protocol) or SCP (Secure Copy Protocol) as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect to an unverified SSH remote host without alerting the user. This could enable an attacker to intercept or manipulate data through a man-in-the-middle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in curl allows an attacker to bypass SSH host verification when a user invokes curl with a schemeless URL and specifies SFTP or SCP as the default protocol. This can lead to man-in-the-middle attacks, enabling data interception or manipulation without user awareness in Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
          "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
          "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12064"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496768",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12064",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12064",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12064"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-12064.html",
          "url": "https://curl.se/docs/CVE-2026-12064.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-12064.json",
          "url": "https://curl.se/docs/CVE-2026-12064.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3797526",
          "url": "https://hackerone.com/reports/3797526"
        }
      ],
      "release_date": "2026-07-03T06:13:55.302000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-17T05:15:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55450"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using the `--proto-default sftp` or `--proto-default scp` options with schemeless URLs when invoking the `curl` command. Instead, explicitly specify the protocol in the URL (e.g., `sftp://host/path` or `scp://host/path`).",
          "product_ids": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.3.x86_64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "AppStream-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.src",
            "BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-debuginfo-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-0:8.12.1-4.el10_2.3.x86_64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.aarch64",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.ppc64le",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.s390x",
            "BaseOS-10.2.Z:libcurl-minimal-debuginfo-0:8.12.1-4.el10_2.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP"
    }
  ]
}

RHSA-2026:57462

Vulnerability from csaf_redhat - Published: 2026-08-20 11:51 - Updated: 2026-08-20 20:44

Summary

Red Hat Security Advisory: curl security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286) Bug Fix(es) and Enhancement(s): * Regression of RHEL-73788. The .9 revision appears to have broken the logic that forces NTLM to use HTTP/1.1. (JIRA:RHEL-171912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-8286

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 45 products

Product	Version	Remediation
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

11 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:57462	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2496763	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-8286	self
https://bugzilla.redhat.com/show_bug.cgi?id=2496763	external
https://www.cve.org/CVERecord?id=CVE-2026-8286	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8286	external
https://curl.se/docs/CVE-2026-8286.html	external
https://curl.se/docs/CVE-2026-8286.json	external
https://hackerone.com/reports/3718195	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for curl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)\n\nBug Fix(es) and Enhancement(s):\n\n* Regression of RHEL-73788. The .9 revision appears to have broken the logic that forces NTLM to use HTTP/1.1. (JIRA:RHEL-171912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:57462",
        "url": "https://access.redhat.com/errata/RHSA-2026:57462"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2496763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57462.json"
      }
    ],
    "title": "Red Hat Security Advisory: curl security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-20T20:44:33+00:00",
      "generator": {
        "date": "2026-08-20T20:44:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:57462",
      "initial_release_date": "2026-08-20T11:51:41+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T11:51:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-20T11:51:41+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-20T20:44:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-34.el8_10.13.src",
                "product": {
                  "name": "curl-0:7.61.1-34.el8_10.13.src",
                  "product_id": "curl-0:7.61.1-34.el8_10.13.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "curl-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "curl-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "libcurl-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "libcurl-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "curl-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "curl-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "libcurl-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "libcurl-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "curl-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "curl-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "libcurl-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "libcurl-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "libcurl-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "libcurl-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "libcurl-devel-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "curl-debugsource-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "curl-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "curl-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "libcurl-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "libcurl-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-devel@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debugsource@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-debuginfo@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/curl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-debuginfo@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                "product": {
                  "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_id": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libcurl-minimal-debuginfo@7.61.1-34.el8_10.13?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "curl-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "curl-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "curl-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-34.el8_10.13.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src"
        },
        "product_reference": "curl-0:7.61.1-34.el8_10.13.src",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "curl-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "curl-debugsource-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-debugsource-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "libcurl-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "libcurl-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "libcurl-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "libcurl-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "libcurl-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "libcurl-devel-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
        },
        "product_reference": "libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
        "relates_to_product_reference": "BaseOS-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8286",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-07-03T07:01:27.043110+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
          "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8286.html",
          "url": "https://curl.se/docs/CVE-2026-8286.html"
        },
        {
          "category": "external",
          "summary": "https://curl.se/docs/CVE-2026-8286.json",
          "url": "https://curl.se/docs/CVE-2026-8286.json"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3718195",
          "url": "https://hackerone.com/reports/3718195"
        }
      ],
      "release_date": "2026-07-03T06:14:17.541000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-20T11:51:41+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:57462"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.src",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-debugsource-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-devel-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-0:7.61.1-34.el8_10.13.x86_64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.aarch64",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.i686",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.ppc64le",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.s390x",
            "BaseOS-8.10.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.61.1-34.el8_10.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    }
  ]
}

rlsa-2026:55439

Vulnerability from osv_rocky

Published

2026-08-17 18:03

Modified

2026-08-20 18:09

Summary

Important: curl security update

Details

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965)
curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783)
curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)
curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:55439	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2446448	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2446450	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2496758	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2496763	REPORT
	https://access.redhat.com/errata/RHSA-2026:55439	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "curl",
        "purl": "pkg:rpm/rocky-linux/curl?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:7.76.1-40.el9_8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:55439"
  },
  "details": "The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication (CVE-2026-1965)\n\n* curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect (CVE-2026-3783)\n\n* curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)\n\n* curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:55439",
  "modified": "2026-08-20T18:09:47.322894Z",
  "published": "2026-08-17T18:03:57.407277Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:55439"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:55439"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: curl security update",
  "upstream": [
    "CVE-2026-1965",
    "CVE-2026-3783",
    "CVE-2026-8286",
    "CVE-2026-9547"
  ]
}

ubuntu-cve-2026-8286

Vulnerability from osv_ubuntu

Published

2026-06-26 14:00

Modified

2026-07-08 07:51

Summary

Details

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2026-8286	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-8286	REPORT
	https://curl.se/L7HzKXisfJ/CVE-2026-8286.md	REPORT
	https://ubuntu.com/security/notices/USN-8487-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.20+esm20?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.35.0-1ubuntu2.20+esm20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.32.0-1ubuntu1",
        "7.33.0-1ubuntu1",
        "7.34.0-1ubuntu1",
        "7.35.0-1ubuntu1",
        "7.35.0-1ubuntu2",
        "7.35.0-1ubuntu2.1",
        "7.35.0-1ubuntu2.2",
        "7.35.0-1ubuntu2.3",
        "7.35.0-1ubuntu2.5",
        "7.35.0-1ubuntu2.6",
        "7.35.0-1ubuntu2.7",
        "7.35.0-1ubuntu2.8",
        "7.35.0-1ubuntu2.9",
        "7.35.0-1ubuntu2.10",
        "7.35.0-1ubuntu2.11",
        "7.35.0-1ubuntu2.12",
        "7.35.0-1ubuntu2.13",
        "7.35.0-1ubuntu2.14",
        "7.35.0-1ubuntu2.15",
        "7.35.0-1ubuntu2.16",
        "7.35.0-1ubuntu2.17",
        "7.35.0-1ubuntu2.19",
        "7.35.0-1ubuntu2.20",
        "7.35.0-1ubuntu2.20+esm2",
        "7.35.0-1ubuntu2.20+esm3",
        "7.35.0-1ubuntu2.20+esm4",
        "7.35.0-1ubuntu2.20+esm5",
        "7.35.0-1ubuntu2.20+esm6",
        "7.35.0-1ubuntu2.20+esm7",
        "7.35.0-1ubuntu2.20+esm8",
        "7.35.0-1ubuntu2.20+esm9",
        "7.35.0-1ubuntu2.20+esm10",
        "7.35.0-1ubuntu2.20+esm11",
        "7.35.0-1ubuntu2.20+esm12",
        "7.35.0-1ubuntu2.20+esm13",
        "7.35.0-1ubuntu2.20+esm14",
        "7.35.0-1ubuntu2.20+esm15",
        "7.35.0-1ubuntu2.20+esm16",
        "7.35.0-1ubuntu2.20+esm17",
        "7.35.0-1ubuntu2.20+esm18",
        "7.35.0-1ubuntu2.20+esm19"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.19+esm16?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.47.0-1ubuntu2.19+esm16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.43.0-1ubuntu2",
        "7.45.0-1ubuntu1",
        "7.46.0-1ubuntu1",
        "7.47.0-1ubuntu1",
        "7.47.0-1ubuntu2",
        "7.47.0-1ubuntu2.1",
        "7.47.0-1ubuntu2.2",
        "7.47.0-1ubuntu2.3",
        "7.47.0-1ubuntu2.4",
        "7.47.0-1ubuntu2.5",
        "7.47.0-1ubuntu2.6",
        "7.47.0-1ubuntu2.7",
        "7.47.0-1ubuntu2.8",
        "7.47.0-1ubuntu2.9",
        "7.47.0-1ubuntu2.11",
        "7.47.0-1ubuntu2.12",
        "7.47.0-1ubuntu2.13",
        "7.47.0-1ubuntu2.14",
        "7.47.0-1ubuntu2.15",
        "7.47.0-1ubuntu2.16",
        "7.47.0-1ubuntu2.18",
        "7.47.0-1ubuntu2.19",
        "7.47.0-1ubuntu2.19+esm1",
        "7.47.0-1ubuntu2.19+esm2",
        "7.47.0-1ubuntu2.19+esm3",
        "7.47.0-1ubuntu2.19+esm4",
        "7.47.0-1ubuntu2.19+esm5",
        "7.47.0-1ubuntu2.19+esm6",
        "7.47.0-1ubuntu2.19+esm7",
        "7.47.0-1ubuntu2.19+esm8",
        "7.47.0-1ubuntu2.19+esm9",
        "7.47.0-1ubuntu2.19+esm10",
        "7.47.0-1ubuntu2.19+esm11",
        "7.47.0-1ubuntu2.19+esm12",
        "7.47.0-1ubuntu2.19+esm13",
        "7.47.0-1ubuntu2.19+esm15"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.58.0-2ubuntu3.24+esm9?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.58.0-2ubuntu3.24+esm9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.55.1-1ubuntu2",
        "7.55.1-1ubuntu2.1",
        "7.57.0-1ubuntu1",
        "7.58.0-2ubuntu1",
        "7.58.0-2ubuntu2",
        "7.58.0-2ubuntu3",
        "7.58.0-2ubuntu3.1",
        "7.58.0-2ubuntu3.2",
        "7.58.0-2ubuntu3.3",
        "7.58.0-2ubuntu3.5",
        "7.58.0-2ubuntu3.6",
        "7.58.0-2ubuntu3.7",
        "7.58.0-2ubuntu3.8",
        "7.58.0-2ubuntu3.9",
        "7.58.0-2ubuntu3.10",
        "7.58.0-2ubuntu3.12",
        "7.58.0-2ubuntu3.13",
        "7.58.0-2ubuntu3.14",
        "7.58.0-2ubuntu3.15",
        "7.58.0-2ubuntu3.16",
        "7.58.0-2ubuntu3.17",
        "7.58.0-2ubuntu3.18",
        "7.58.0-2ubuntu3.19",
        "7.58.0-2ubuntu3.20",
        "7.58.0-2ubuntu3.21",
        "7.58.0-2ubuntu3.22",
        "7.58.0-2ubuntu3.23",
        "7.58.0-2ubuntu3.24",
        "7.58.0-2ubuntu3.24+esm1",
        "7.58.0-2ubuntu3.24+esm2",
        "7.58.0-2ubuntu3.24+esm3",
        "7.58.0-2ubuntu3.24+esm4",
        "7.58.0-2ubuntu3.24+esm5",
        "7.58.0-2ubuntu3.24+esm7",
        "7.58.0-2ubuntu3.24+esm8"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25+esm4?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.68.0-1ubuntu2.25+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.65.3-1ubuntu3",
        "7.65.3-1ubuntu4",
        "7.66.0-1ubuntu1",
        "7.67.0-2ubuntu1",
        "7.68.0-1ubuntu1",
        "7.68.0-1ubuntu2",
        "7.68.0-1ubuntu2.1",
        "7.68.0-1ubuntu2.2",
        "7.68.0-1ubuntu2.4",
        "7.68.0-1ubuntu2.5",
        "7.68.0-1ubuntu2.6",
        "7.68.0-1ubuntu2.7",
        "7.68.0-1ubuntu2.10",
        "7.68.0-1ubuntu2.11",
        "7.68.0-1ubuntu2.12",
        "7.68.0-1ubuntu2.13",
        "7.68.0-1ubuntu2.14",
        "7.68.0-1ubuntu2.15",
        "7.68.0-1ubuntu2.16",
        "7.68.0-1ubuntu2.18",
        "7.68.0-1ubuntu2.19",
        "7.68.0-1ubuntu2.20",
        "7.68.0-1ubuntu2.21",
        "7.68.0-1ubuntu2.22",
        "7.68.0-1ubuntu2.23",
        "7.68.0-1ubuntu2.24",
        "7.68.0-1ubuntu2.25",
        "7.68.0-1ubuntu2.25+esm2",
        "7.68.0-1ubuntu2.25+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.25"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.25?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8",
        "7.81.0-1ubuntu1.10",
        "7.81.0-1ubuntu1.11",
        "7.81.0-1ubuntu1.13",
        "7.81.0-1ubuntu1.14",
        "7.81.0-1ubuntu1.15",
        "7.81.0-1ubuntu1.16",
        "7.81.0-1ubuntu1.17",
        "7.81.0-1ubuntu1.18",
        "7.81.0-1ubuntu1.19",
        "7.81.0-1ubuntu1.20",
        "7.81.0-1ubuntu1.21",
        "7.81.0-1ubuntu1.22",
        "7.81.0-1ubuntu1.23",
        "7.81.0-1ubuntu1.24"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.5.0-2ubuntu10.10"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.5.0-2ubuntu10.10?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.0-2ubuntu10.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.2.1-1ubuntu3",
        "8.2.1-1ubuntu3.1",
        "8.4.0-2ubuntu1",
        "8.5.0-2ubuntu1",
        "8.5.0-2ubuntu2",
        "8.5.0-2ubuntu8",
        "8.5.0-2ubuntu9",
        "8.5.0-2ubuntu10",
        "8.5.0-2ubuntu10.1",
        "8.5.0-2ubuntu10.2",
        "8.5.0-2ubuntu10.3",
        "8.5.0-2ubuntu10.4",
        "8.5.0-2ubuntu10.5",
        "8.5.0-2ubuntu10.6",
        "8.5.0-2ubuntu10.7",
        "8.5.0-2ubuntu10.8",
        "8.5.0-2ubuntu10.9"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.4"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.14.1-2ubuntu1.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.14.1-2ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.12.1-3ubuntu1",
        "8.13.0-5ubuntu1",
        "8.14.1-1ubuntu2",
        "8.14.1-1ubuntu3",
        "8.14.1-2ubuntu1",
        "8.14.1-2ubuntu1.1",
        "8.14.1-2ubuntu1.2",
        "8.14.1-2ubuntu1.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.2"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.",
  "id": "UBUNTU-CVE-2026-8286",
  "modified": "2026-07-08T07:51:39Z",
  "published": "2026-06-26T14:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8286"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8487-1"
    }
  ],
  "related": [
    "USN-8487-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-8286"
  ]
}

WID-SEC-W-2026-2065

Vulnerability from csaf_certbund - Published: 2026-06-24 22:00 - Updated: 2026-08-02 22:00

Summary

cURL: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-8286

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8458

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8924

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8925

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8926

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8927

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-8932

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

CVE-2026-9079

Affected products

Known affected 8 products

Product	Identifier	Version
IBM AIX 7.3 IBM / AIX	`cpe:/o:ibm:aix:7.3`	7.3
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Meinberg LANTIME <V7.10.013 Meinberg / LANTIME		<V7.10.013
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3
Open Source cURL <8.21.0 Open Source / cURL		<8.21.0

References

24 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://curl.se/docs/CVE-2026-8286.html	external
https://curl.se/docs/CVE-2026-8458.html	external
https://curl.se/docs/CVE-2026-8924.html	external
https://curl.se/docs/CVE-2026-8925.html	external
https://curl.se/docs/CVE-2026-8926.html	external
https://curl.se/docs/CVE-2026-8927.html	external
https://curl.se/docs/CVE-2026-8932.html	external
https://curl.se/docs/CVE-2026-9079.html	external
https://ubuntu.com/security/notices/USN-8487-1	external
https://access.redhat.com/errata/RHSA-2026:29017	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://msrc.microsoft.com/update-guide/	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
http://news.meinberg.de/680/	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://www.ibm.com/support/pages/node/7281743	external
https://aix.software.ibm.com/aix/efixes/security/…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2065 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2065.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2065 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2065"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8286.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8458.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8924.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8925.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8926.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8927.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-8932.html"
      },
      {
        "category": "external",
        "summary": "Curl Document vom 2026-06-24",
        "url": "https://curl.se/docs/CVE-2026-9079.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8487-1 vom 2026-07-01",
        "url": "https://ubuntu.com/security/notices/USN-8487-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:29017 vom 2026-07-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:29017"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22553-1 vom 2026-07-13",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027394.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2926-1 vom 2026-07-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027426.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2925-1 vom 2026-07-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027427.html"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2026-07-14",
        "url": "https://msrc.microsoft.com/update-guide/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22582-1 vom 2026-07-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027438.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3043-1 vom 2026-07-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027507.html"
      },
      {
        "category": "external",
        "summary": "Meinberg Security Advisory MBGSA-2026.05 vom 2026-07-21",
        "url": "http://news.meinberg.de/680/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22709-1 vom 2026-07-22",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027723.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:22889-1 vom 2026-07-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027871.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7281743 vom 2026-07-29",
        "url": "https://www.ibm.com/support/pages/node/7281743"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6985269 vom 2026-07-28",
        "url": "https://aix.software.ibm.com/aix/efixes/security/curl_advisory11.asc"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-E691FBBFE7 vom 2026-07-31",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e691fbbfe7"
      }
    ],
    "source_lang": "en-US",
    "title": "cURL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-02T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-03T07:18:06.285+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2065",
      "initial_release_date": "2026-06-24T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-24T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-30T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-07-02T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-13T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-07-15T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Meinberg aufgenommen"
        },
        {
          "date": "2026-07-22T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-07-27T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-08-02T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Fedora aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74178",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.3",
                "product": {
                  "name": "IBM AIX 7.3",
                  "product_id": "1139691",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:ibm:aix:7.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AIX"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV7.10.013",
                "product": {
                  "name": "Meinberg LANTIME \u003cV7.10.013",
                  "product_id": "T056848"
                }
              },
              {
                "category": "product_version",
                "name": "V7.10.013",
                "product": {
                  "name": "Meinberg LANTIME V7.10.013",
                  "product_id": "T056848-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:meinberg:lantime:v7.10.013"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "LANTIME"
          }
        ],
        "category": "vendor",
        "name": "Meinberg"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "azl3",
                "product": {
                  "name": "Microsoft Azure Linux azl3",
                  "product_id": "T049210",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:microsoft:azure_linux:azl3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.21.0",
                "product": {
                  "name": "Open Source cURL \u003c8.21.0",
                  "product_id": "T055763"
                }
              },
              {
                "category": "product_version",
                "name": "8.21.0",
                "product": {
                  "name": "Open Source cURL 8.21.0",
                  "product_id": "T055763-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:curl:curl:8.21.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "cURL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T054646",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8286",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8286"
    },
    {
      "cve": "CVE-2026-8458",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8458"
    },
    {
      "cve": "CVE-2026-8924",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8924"
    },
    {
      "cve": "CVE-2026-8925",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8925"
    },
    {
      "cve": "CVE-2026-8926",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8926"
    },
    {
      "cve": "CVE-2026-8927",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8927"
    },
    {
      "cve": "CVE-2026-8932",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-8932"
    },
    {
      "cve": "CVE-2026-9079",
      "product_status": {
        "known_affected": [
          "1139691",
          "67646",
          "T000126",
          "T056848",
          "74178",
          "T054646",
          "T049210",
          "T055763"
        ]
      },
      "release_date": "2026-06-24T22:00:00.000+00:00",
      "title": "CVE-2026-9079"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-8286 (GCVE-0-2026-8286)

RHSA-2026:55450

RHSA-2026:57462

rlsa-2026:55439

Vulnerability from osv_rocky

ubuntu-cve-2026-8286

Vulnerability from osv_ubuntu

WID-SEC-W-2026-2065

Tags

Sightings

Nomenclature