Curl Security Update — AlmaLinux 8 (ALSA-2026:92368)

ALSA-2026:92368 updates curl/libcurl on AlmaLinux 8 with five CVE fixes (CVE-2026-8932, CVE-2026-8458, CVE-2026-8924, CVE-2026-11856, CVE-2026-8927) — including a security-feature bypass via improper mTLS certificate handling (CWE-305), aggregate CVSS 7.5. Update with dnf update curl libcurl and restart services linking the library (PHP-FPM, Apache).

High 7.5 CVSS 2026-10-29

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

An mTLS certificate-check bypass defeats exactly the validation that was supposed to authenticate a connection — services relying on mutual TLS for API or internal-service trust lose that guarantee until patched.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
* curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

* Backport upstream curl PR #6852 (“h2: allow 100 streams by default”) to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	libcurl-devel-7.61.1-34.el8_10.18.aarch64.rpm	1966231e8f2541a9b455c86992443f1140e772b2e331bded983b53e1db2dad83
aarch64	libcurl-7.61.1-34.el8_10.18.aarch64.rpm	9c1786febd6f0a408b00fd219bfd34f8c4723d1e8f59a5c7629204a72e4b198e
aarch64	libcurl-minimal-7.61.1-34.el8_10.18.aarch64.rpm	a80ef49881574473fc88a08e1820df3937ed269e5b17986e66553500bed50bc8
aarch64	curl-7.61.1-34.el8_10.18.aarch64.rpm	efb8b676e07c7d469c2afdac009588c0193e3d2dc9e624204b8dcdee59660746
i686	libcurl-7.61.1-34.el8_10.18.i686.rpm	5562d8d1d8d7858ffc62a0c544711ba3ac2c882802a81140f5f115669dbd6cfc
i686	libcurl-minimal-7.61.1-34.el8_10.18.i686.rpm	884b6bb163d1625e75d8609ad005d338cf064d09ee3d1ac2dab6df5f23e01306
i686	libcurl-devel-7.61.1-34.el8_10.18.i686.rpm	b45c960143ce5c41db478af0422f49d272b70ff59779fc1776c39359a112f47e
ppc64le	libcurl-7.61.1-34.el8_10.18.ppc64le.rpm	43d2cfcba1d9127a2d089ec6d35a25fed7c877a37de8e4f4a229057227a37780
ppc64le	libcurl-minimal-7.61.1-34.el8_10.18.ppc64le.rpm	727efbda36e824d6db27b17ece952d474733016cca36f962f84090597b7f6f19
ppc64le	curl-7.61.1-34.el8_10.18.ppc64le.rpm	90fbb7675a8b7b3966b8d2dff48b16a828e4dec06e947b396bdb1e9c8ad5d2a1
ppc64le	libcurl-devel-7.61.1-34.el8_10.18.ppc64le.rpm	cbdebedf17fde9eb114fabf1e8ab1cc65f08a00f7c753b5f54b7658f722e2539
s390x	libcurl-7.61.1-34.el8_10.18.s390x.rpm	61d32f8b1a145369b6f9bbbfc91cbc8d079c9359a30b54ca4e08b6b8f33336d4
s390x	curl-7.61.1-34.el8_10.18.s390x.rpm	6af5a4cc9bf45b8079e92df99ec4d872d2e7c41dbf7c28c624b9ae8411c0f315
s390x	libcurl-minimal-7.61.1-34.el8_10.18.s390x.rpm	b690c2dcf097f72a4da9cad477651d7adbc34b72c90c94fe5e1c0ff5483db715
s390x	libcurl-devel-7.61.1-34.el8_10.18.s390x.rpm	bf740de59c9f0c5ba6fafa27122c45b7ed9f621726a853896c533da928670a7c
x86_64	libcurl-devel-7.61.1-34.el8_10.18.x86_64.rpm	54e5a79ce4cca894f67c1fb55363df9287ad9e25c5aeb54c21e8f9e9e604e915
x86_64	libcurl-minimal-7.61.1-34.el8_10.18.x86_64.rpm	55e2cac3aa522f98adb11cdf336594920756e6afab53834c33bd03c1a025f88e
x86_64	libcurl-7.61.1-34.el8_10.18.x86_64.rpm	58af99e8392a054c6318f3954ae469f4315776af6ec0b91171ba0449f009e7d6
x86_64	curl-7.61.1-34.el8_10.18.x86_64.rpm	b6d73d74cee5196645cf124c11c73770c1334f025ea0e7c29326b9486eb6a324

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:92368?

It is AlmaLinux's curl erratum for AlmaLinux 8, fixing five CVEs (CVE-2026-8932, CVE-2026-8458, CVE-2026-8924, CVE-2026-11856, CVE-2026-8927) including a security-feature bypass via improper mTLS certificate handling (CWE-305), aggregate CVSS 7.5.

Who is affected?

Virtually every server — curl and libcurl are universal dependencies, pulled in by PHP applications, cron jobs, monitoring agents and anything else that fetches URLs.

How do I apply the fix?

Run dnf update curl libcurl, then restart services that embed libcurl (PHP-FPM, Apache, application daemons) so they load the patched library. Verify with curl --version.

Why does the mTLS bypass matter?

Mutual TLS is used where certificate identity IS the authentication — service-to-service APIs, payment endpoints, internal admin tools. A bypass means a connection that should fail verification succeeds, removing the trust guarantee those setups are built on.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen