ELSA-2026-92368

ELSA-2026-92368 - curl security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-29

Description

[7.61.1-34.el8_10.18]
- fix incomplete mTLS config in connection reuse (CVE-2026-8932)

[7.61.1-34.el8_10.17]
- fix cookie injection via trailing dot super cookies (CVE-2026-8924)
- fix digest auth state leak on origin or credential change (CVE-2026-11856)

[7.61.1-34.el8_10.16]
- add sasl service name to connection reuse checks (CVE-2026-8458)

[7.61.1-34.el8_10.15]
- detect proxy changes read from environment (CVE-2026-8927)

[7.61.1-34.el8_10.14]
- h2: allow 100 streams by default (RHEL-232829)
- tests: disable 1701 (h2c POST Upgrade vs nghttpx CVE-2026-58055)

Related CVEs

CVE-2026-11856

CVE-2026-8458

CVE-2026-8924

CVE-2026-8927

CVE-2026-8932

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	curl-7.61.1-34.el8_10.18.src.rpm	bda8e5c08cb2d73ba3285ef40072b39a1fa249c52ba669bc48f2d51a8ad2805e	-	ol8_aarch64_baseos_latest
	curl-7.61.1-34.el8_10.18.src.rpm	bda8e5c08cb2d73ba3285ef40072b39a1fa249c52ba669bc48f2d51a8ad2805e	-	ol8_aarch64_u10_baseos_patch
	curl-7.61.1-34.el8_10.18.aarch64.rpm	3f38fc9011bc3ca0b4f5d89b50eeb71de6759895f3b43a87efbcfdfe0b74fa64	-	ol8_aarch64_baseos_latest
	curl-7.61.1-34.el8_10.18.aarch64.rpm	3f38fc9011bc3ca0b4f5d89b50eeb71de6759895f3b43a87efbcfdfe0b74fa64	-	ol8_aarch64_u10_baseos_patch
	libcurl-7.61.1-34.el8_10.18.aarch64.rpm	6eaeef51da2a1ce930b038902e820482dc24bf9e50692e6dc441de966af49aba	-	ol8_aarch64_baseos_latest
	libcurl-7.61.1-34.el8_10.18.aarch64.rpm	6eaeef51da2a1ce930b038902e820482dc24bf9e50692e6dc441de966af49aba	-	ol8_aarch64_u10_baseos_patch
	libcurl-devel-7.61.1-34.el8_10.18.aarch64.rpm	b4d09472da9aa5988ec11afc89f046d697ef2f72c038c9c7e636260c50d80d6a	-	ol8_aarch64_baseos_latest
	libcurl-devel-7.61.1-34.el8_10.18.aarch64.rpm	b4d09472da9aa5988ec11afc89f046d697ef2f72c038c9c7e636260c50d80d6a	-	ol8_aarch64_u10_baseos_patch
	libcurl-minimal-7.61.1-34.el8_10.18.aarch64.rpm	d0aa919806302499ee0f82969c36ba5ab299a2aaaaf53104489faa056c6fc802	-	ol8_aarch64_baseos_latest
	libcurl-minimal-7.61.1-34.el8_10.18.aarch64.rpm	d0aa919806302499ee0f82969c36ba5ab299a2aaaaf53104489faa056c6fc802	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	curl-7.61.1-34.el8_10.18.src.rpm	bda8e5c08cb2d73ba3285ef40072b39a1fa249c52ba669bc48f2d51a8ad2805e	-	ol8_x86_64_baseos_latest
	curl-7.61.1-34.el8_10.18.src.rpm	bda8e5c08cb2d73ba3285ef40072b39a1fa249c52ba669bc48f2d51a8ad2805e	-	ol8_x86_64_u10_baseos_patch
	curl-7.61.1-34.el8_10.18.x86_64.rpm	6113905af7ba21aa29257d7bf1c913e83b6b670258330514c30f94621b7cd78d	-	ol8_x86_64_baseos_latest
	curl-7.61.1-34.el8_10.18.x86_64.rpm	6113905af7ba21aa29257d7bf1c913e83b6b670258330514c30f94621b7cd78d	-	ol8_x86_64_u10_baseos_patch
	libcurl-7.61.1-34.el8_10.18.i686.rpm	5a89189fcfa61bff5032a19965439bdb63d27087a4f8f28c2116dcf1dd254b89	-	ol8_x86_64_baseos_latest
	libcurl-7.61.1-34.el8_10.18.i686.rpm	5a89189fcfa61bff5032a19965439bdb63d27087a4f8f28c2116dcf1dd254b89	-	ol8_x86_64_u10_baseos_patch
	libcurl-7.61.1-34.el8_10.18.x86_64.rpm	d10007736e788fffb696183ac738dfb1efea646113b5104ffa0b4cc6cc383274	-	ol8_x86_64_baseos_latest
	libcurl-7.61.1-34.el8_10.18.x86_64.rpm	d10007736e788fffb696183ac738dfb1efea646113b5104ffa0b4cc6cc383274	-	ol8_x86_64_u10_baseos_patch
	libcurl-devel-7.61.1-34.el8_10.18.i686.rpm	8dde4b6dd6c1ae6377a263a7501edf0e011e27ac44c120b21d8c211793c787a4	-	ol8_x86_64_baseos_latest
	libcurl-devel-7.61.1-34.el8_10.18.i686.rpm	8dde4b6dd6c1ae6377a263a7501edf0e011e27ac44c120b21d8c211793c787a4	-	ol8_x86_64_u10_baseos_patch
	libcurl-devel-7.61.1-34.el8_10.18.x86_64.rpm	80dd3df59ac6995a84c6d8d8bdafc85ef7d0e98c2edfae834a8103581e747e66	-	ol8_x86_64_baseos_latest
	libcurl-devel-7.61.1-34.el8_10.18.x86_64.rpm	80dd3df59ac6995a84c6d8d8bdafc85ef7d0e98c2edfae834a8103581e747e66	-	ol8_x86_64_u10_baseos_patch
	libcurl-minimal-7.61.1-34.el8_10.18.i686.rpm	46ec3071c5225a299402cbdf04314f88dcdf029f82c59ca97adc7b729c265753	-	ol8_x86_64_baseos_latest
	libcurl-minimal-7.61.1-34.el8_10.18.i686.rpm	46ec3071c5225a299402cbdf04314f88dcdf029f82c59ca97adc7b729c265753	-	ol8_x86_64_u10_baseos_patch
	libcurl-minimal-7.61.1-34.el8_10.18.x86_64.rpm	995ee0137b6babf2d5608328944f26dff3cfc8b980460e9ff4322b8246c57b56	-	ol8_x86_64_baseos_latest
	libcurl-minimal-7.61.1-34.el8_10.18.x86_64.rpm	995ee0137b6babf2d5608328944f26dff3cfc8b980460e9ff4322b8246c57b56	-	ol8_x86_64_u10_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team