ELSA-2026-80512

ELSA-2026-80512 - curl security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-10-11

Description

[8.12.1-4.el10_2.7]
- fix http2 stream dependency tracking security issue (CVE-2026-10536)
- fix negotiate state check on connection reuse (CVE-2026-5545)
- fix proxy auth not cleared on proxy change (CVE-2026-7168)
- fix credentials not cleared on redirect (CVE-2026-6253)
- fix HTTP credentials leak on cross-origin redirect (CVE-2026-6429)

Related CVEs

CVE-2026-10536

CVE-2026-5545

CVE-2026-6253

CVE-2026-6429

CVE-2026-7168

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_aarch64_appstream
	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_aarch64_u2_baseos_patch
	curl-8.12.1-4.el10_2.7.aarch64.rpm	7d2749053b82f0d7802237b7788aef0c7f202f1cea93707bc0d0c25214ff9865	-	ol10_aarch64_baseos_latest
	curl-8.12.1-4.el10_2.7.aarch64.rpm	7d2749053b82f0d7802237b7788aef0c7f202f1cea93707bc0d0c25214ff9865	-	ol10_aarch64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.7.aarch64.rpm	a4e5de1c83df0f2c40b2167bce7298dc603fa98572e6f724640180d84a07b614	-	ol10_aarch64_baseos_latest
	libcurl-8.12.1-4.el10_2.7.aarch64.rpm	a4e5de1c83df0f2c40b2167bce7298dc603fa98572e6f724640180d84a07b614	-	ol10_aarch64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.7.aarch64.rpm	22797d9a4a57ed5476809bce89584123e784d51d71889e7b757193aeec17cc43	-	ol10_aarch64_appstream
	libcurl-minimal-8.12.1-4.el10_2.7.aarch64.rpm	e8d1c934e33a61102a2e86597ddc994ef91c79a079d541314b5749f151a3a5fc	-	ol10_aarch64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.7.aarch64.rpm	e8d1c934e33a61102a2e86597ddc994ef91c79a079d541314b5749f151a3a5fc	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_x86_64_appstream
	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.7.src.rpm	5bb203850fea90112a7be97b353018d4724fdae20406f881cc78d1c4d9808350	-	ol10_x86_64_u2_baseos_patch
	curl-8.12.1-4.el10_2.7.x86_64.rpm	bb5750c88205fd6ef6d9775e6c3b347d5c8f644aca27cfa468dfd9130168c79f	-	ol10_x86_64_baseos_latest
	curl-8.12.1-4.el10_2.7.x86_64.rpm	bb5750c88205fd6ef6d9775e6c3b347d5c8f644aca27cfa468dfd9130168c79f	-	ol10_x86_64_u2_baseos_patch
	libcurl-8.12.1-4.el10_2.7.x86_64.rpm	aa2e519df63719a49dc1afc86b1fdbbaa43bec7da21c2069100dbc6814292bf4	-	ol10_x86_64_baseos_latest
	libcurl-8.12.1-4.el10_2.7.x86_64.rpm	aa2e519df63719a49dc1afc86b1fdbbaa43bec7da21c2069100dbc6814292bf4	-	ol10_x86_64_u2_baseos_patch
	libcurl-devel-8.12.1-4.el10_2.7.x86_64.rpm	0dc890d2e586ca532461a2b99648502f93b2d5f076ba478d1a4791c8271eb963	-	ol10_x86_64_appstream
	libcurl-minimal-8.12.1-4.el10_2.7.x86_64.rpm	b33c1ff891bec47e143f478758d8aae9544585219b8039bf1c2a9959b14066c1	-	ol10_x86_64_baseos_latest
	libcurl-minimal-8.12.1-4.el10_2.7.x86_64.rpm	b33c1ff891bec47e143f478758d8aae9544585219b8039bf1c2a9959b14066c1	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team