ELSA-2026-69125

ELSA-2026-69125 - curl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-23

Description

[8.12.1-4.6]
- fix cookie injection via trailing dot super cookies (CVE-2026-8924)
- fix digest auth state leak on origin or credential change (CVE-2026-11856)
- fix netrc password lookup for non-matching login (CVE-2026-8926)

[8.12.1-4.5]
- fix proxy auth not cleared properly on NULL (CVE-2026-9079)
- fix incomplete mTLS config in connection reuse and session cache
(CVE-2026-8932)
- fix SASL service name connection reuse bypass (CVE-2026-8458)

Related CVEs

CVE-2026-11856

CVE-2026-8458

CVE-2026-8924

CVE-2026-8926

CVE-2026-8932

CVE-2026-9079

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_aarch64_appstream
	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_aarch64_u2_baseos_patch
	curl-8.12.1-4.el10_2.6.aarch64.rpm	ef83b9935ed9c9eee77216f14feb3b5e078949b3aacb974ed5aff25e7e66793f	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.6.aarch64.rpm	ef83b9935ed9c9eee77216f14feb3b5e078949b3aacb974ed5aff25e7e66793f	-	ol10_aarch64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.6.aarch64.rpm	a24f774509695da9feeb24b984032a0e6c1ccbf81a18291d28304150aada3349	-	ol10_aarch64_baseos_latest
	libcurl-8.12.1-4.el10_2.6.aarch64.rpm	a24f774509695da9feeb24b984032a0e6c1ccbf81a18291d28304150aada3349	-	ol10_aarch64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.6.aarch64.rpm	b55ef111f63e4498b2ba0a7bd9d2da8c9333f58c64dc2211c7ce1a487b7ff0f7	-	ol10_aarch64_appstream
	libcurl-minimal-8.12.1-4.el10_2.6.aarch64.rpm	6858ada576b810528e95f14ff521d28d7e72ba3a3ce0f74bdb5b37332d3f799a	-	ol10_aarch64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.6.aarch64.rpm	6858ada576b810528e95f14ff521d28d7e72ba3a3ce0f74bdb5b37332d3f799a	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_x86_64_appstream
	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.6.src.rpm	15d28b5f05e96950c6a5df6e3fc7f3a9867fc11b9c8c0be11852d9f9a073c53c	-	ol10_x86_64_u2_baseos_patch
	curl-8.12.1-4.el10_2.6.x86_64.rpm	da464cab9431501687c8e16943c539b4f67012fb307f6e7f0487b686895e9039	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.6.x86_64.rpm	da464cab9431501687c8e16943c539b4f67012fb307f6e7f0487b686895e9039	-	ol10_x86_64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.6.x86_64.rpm	0e5f614af12758b0ad006210896eea6f666b8a07504da2ce2899e816e37ca543	-	ol10_x86_64_baseos_latest
	libcurl-8.12.1-4.el10_2.6.x86_64.rpm	0e5f614af12758b0ad006210896eea6f666b8a07504da2ce2899e816e37ca543	-	ol10_x86_64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.6.x86_64.rpm	ecca6f9c4bca03a666d88303d4501d712c818abab10d6ff86df94db18ac5664d	-	ol10_x86_64_appstream
	libcurl-minimal-8.12.1-4.el10_2.6.x86_64.rpm	ca35ef50f006050049672bee552e201a7f657d5b73b60e447c7fcb208c01ebc8	-	ol10_x86_64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.6.x86_64.rpm	ca35ef50f006050049672bee552e201a7f657d5b73b60e447c7fcb208c01ebc8	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team