ELSA-2026-55439

ELSA-2026-55439 - curl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-17

Description

[7.76.1-40.el9_8.5]
- fix missing %patch macros for Patch46 and Patch47

[7.76.1-40.el9_8.4]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)

[7.76.1-40.3]
- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)

[7.76.1-40.1]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Related CVEs

CVE-2026-1965

CVE-2026-3783

CVE-2026-8286

CVE-2026-9547

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_aarch64_appstream
	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_aarch64_baseos_latest
	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_aarch64_u8_baseos_patch
	curl-7.76.1-40.el9_8.5.aarch64.rpm	848467a7e025bed222c46d76c786fd164be9380fafdeab2bb33898723befda3f	-	ol9_aarch64_baseos_latest
	curl-7.76.1-40.el9_8.5.aarch64.rpm	848467a7e025bed222c46d76c786fd164be9380fafdeab2bb33898723befda3f	-	ol9_aarch64_u8_baseos_patch
	curl-minimal-7.76.1-40.el9_8.5.aarch64.rpm	46172f8888dde023309007728ba432a0199d8d6de8aa5e0d6c0f4c5370dfb94d	-	ol9_aarch64_baseos_latest
	curl-minimal-7.76.1-40.el9_8.5.aarch64.rpm	46172f8888dde023309007728ba432a0199d8d6de8aa5e0d6c0f4c5370dfb94d	-	ol9_aarch64_u8_baseos_patch
	libcurl-7.76.1-40.el9_8.5.aarch64.rpm	54262c74c9a924541e4264ba9f48d15c7d6e16ceb1bab05f227ac42c9d5cc24f	-	ol9_aarch64_baseos_latest
	libcurl-7.76.1-40.el9_8.5.aarch64.rpm	54262c74c9a924541e4264ba9f48d15c7d6e16ceb1bab05f227ac42c9d5cc24f	-	ol9_aarch64_u8_baseos_patch
	libcurl-devel-7.76.1-40.el9_8.5.aarch64.rpm	6ff63d6ca33fcefe89685005aa412524b3281489299c7d8e897dbc5dd2e03f75	-	ol9_aarch64_appstream
	libcurl-minimal-7.76.1-40.el9_8.5.aarch64.rpm	ec1005f91438a966dedb34c688cb2d60a9c94089dfc3c9b37c7beb9335f99089	-	ol9_aarch64_baseos_latest
	libcurl-minimal-7.76.1-40.el9_8.5.aarch64.rpm	ec1005f91438a966dedb34c688cb2d60a9c94089dfc3c9b37c7beb9335f99089	-	ol9_aarch64_u8_baseos_patch
Oracle Linux 9 (x86_64)	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_x86_64_appstream
	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_x86_64_baseos_latest
	curl-7.76.1-40.el9_8.5.src.rpm	852676a8ae089df7064967c4b6c5aad2c80e6fba2c8bd8d7cf612841e0ae8c47	-	ol9_x86_64_u8_baseos_patch
	curl-7.76.1-40.el9_8.5.x86_64.rpm	18d6cdf81b8c2836beb9945b3a455e7fd184b88809737b68b9f52e73d52ffce9	-	ol9_x86_64_baseos_latest
	curl-7.76.1-40.el9_8.5.x86_64.rpm	18d6cdf81b8c2836beb9945b3a455e7fd184b88809737b68b9f52e73d52ffce9	-	ol9_x86_64_u8_baseos_patch
	curl-minimal-7.76.1-40.el9_8.5.x86_64.rpm	b6248382aafefe50727fa85e22279e80fc924ad6f59ef41ca5bc85d3cec16f81	-	ol9_x86_64_baseos_latest
	curl-minimal-7.76.1-40.el9_8.5.x86_64.rpm	b6248382aafefe50727fa85e22279e80fc924ad6f59ef41ca5bc85d3cec16f81	-	ol9_x86_64_u8_baseos_patch
	libcurl-7.76.1-40.el9_8.5.i686.rpm	e64a350c6e7c2104e17728da00cd48d3f401cadd857b4108d7a6025549fd4c28	-	ol9_x86_64_baseos_latest
	libcurl-7.76.1-40.el9_8.5.i686.rpm	e64a350c6e7c2104e17728da00cd48d3f401cadd857b4108d7a6025549fd4c28	-	ol9_x86_64_u8_baseos_patch
	libcurl-7.76.1-40.el9_8.5.x86_64.rpm	1b0394de0a1dc08487ba2b3991c22efd9b757c97e11213a632988cd6736d685c	-	ol9_x86_64_baseos_latest
	libcurl-7.76.1-40.el9_8.5.x86_64.rpm	1b0394de0a1dc08487ba2b3991c22efd9b757c97e11213a632988cd6736d685c	-	ol9_x86_64_u8_baseos_patch
	libcurl-devel-7.76.1-40.el9_8.5.i686.rpm	0237083234030745f114882b5f9159a2955cd3ef548149d56f41062e6613724f	-	ol9_x86_64_appstream
	libcurl-devel-7.76.1-40.el9_8.5.x86_64.rpm	239df3a8936a48d4e739fa287f4c623fa53e68ee908dd742c40730ed1c03f35a	-	ol9_x86_64_appstream
	libcurl-minimal-7.76.1-40.el9_8.5.i686.rpm	33a8c076173fbf8051999cfa653b9b1271cd530a2ea717dfe959ffaf880c63f2	-	ol9_x86_64_baseos_latest
	libcurl-minimal-7.76.1-40.el9_8.5.i686.rpm	33a8c076173fbf8051999cfa653b9b1271cd530a2ea717dfe959ffaf880c63f2	-	ol9_x86_64_u8_baseos_patch
	libcurl-minimal-7.76.1-40.el9_8.5.x86_64.rpm	44c04520f67e971d1bfde21786efee7cf2a426c275ac6882d621379548e3818a	-	ol9_x86_64_baseos_latest
	libcurl-minimal-7.76.1-40.el9_8.5.x86_64.rpm	44c04520f67e971d1bfde21786efee7cf2a426c275ac6882d621379548e3818a	-	ol9_x86_64_u8_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team