ELSA-2026-55432

ELSA-2026-55432 - curl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-17

Description

[8.12.1-4.4]
- fix proxy environment variable change detection (CVE-2026-8927)

[8.12.1-4.el10_2.3]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- fix proxy connection reuse with wrong credentials (CVE-2026-3784)

[8.12.1-4.2]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix schemeless URL handling with --proto-default (CVE-2026-12064)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

[8.12.1-4.1]
- openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)

Related CVEs

CVE-2026-8927

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_aarch64_appstream
	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_aarch64_u2_baseos_patch
	curl-8.12.1-4.el10_2.4.aarch64.rpm	b93b53bb295b056e07dc1db115fa3575ac9e8af34fcaf51ce1325e7bc3964500	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.4.aarch64.rpm	b93b53bb295b056e07dc1db115fa3575ac9e8af34fcaf51ce1325e7bc3964500	-	ol10_aarch64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.4.aarch64.rpm	9b03399e457fe270451bd918cc8c674d90eebb0f9f287f2b4978300a4d4e5de3	-	ol10_aarch64_baseos_latest
	libcurl-8.12.1-4.el10_2.4.aarch64.rpm	9b03399e457fe270451bd918cc8c674d90eebb0f9f287f2b4978300a4d4e5de3	-	ol10_aarch64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.4.aarch64.rpm	34a45f94a94442c14b4c1b151a00193173f1f940296175a8b41dab53dd27e104	-	ol10_aarch64_appstream
	libcurl-minimal-8.12.1-4.el10_2.4.aarch64.rpm	fa394da93c7e2a56f952c848ce12c2a729a647b631f57e92c43d62716d181fb0	-	ol10_aarch64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.4.aarch64.rpm	fa394da93c7e2a56f952c848ce12c2a729a647b631f57e92c43d62716d181fb0	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_x86_64_appstream
	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.4.src.rpm	d7a4347f19504e77d5e9b29015dfc944df0992b03d676025fd0a3bb67063ac1a	-	ol10_x86_64_u2_baseos_patch
	curl-8.12.1-4.el10_2.4.x86_64.rpm	d0f2394f77f3b58a8ed4162c1d82cc11e1a0dadc131582da2c4e1c5871e6f76c	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.4.x86_64.rpm	d0f2394f77f3b58a8ed4162c1d82cc11e1a0dadc131582da2c4e1c5871e6f76c	-	ol10_x86_64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.4.x86_64.rpm	0dca25198dbaa3bc389535b9b48516b4ce27f7fad2623f8d891aa6c392cface0	-	ol10_x86_64_baseos_latest
	libcurl-8.12.1-4.el10_2.4.x86_64.rpm	0dca25198dbaa3bc389535b9b48516b4ce27f7fad2623f8d891aa6c392cface0	-	ol10_x86_64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.4.x86_64.rpm	9ecb5742d43b579fd94944d5cd7e1f493ceef671131e3742248a7f4da32c999d	-	ol10_x86_64_appstream
	libcurl-minimal-8.12.1-4.el10_2.4.x86_64.rpm	7a8cbfc7ab70cf01819cb5b5fb2db060102e519853d8ef9823307083b96b74fd	-	ol10_x86_64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.4.x86_64.rpm	7a8cbfc7ab70cf01819cb5b5fb2db060102e519853d8ef9823307083b96b74fd	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team