Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc (crlsa-2026_57462)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657462 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of Rocky Linux-73788. The .9...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.4:CLSA-2026:1785319688)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785319688 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even thoug...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_55439)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655439 advisory. curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl: Information disclosure via...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1786464575)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1786464575 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

GHSA-P569-5GJG-9CMJ rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

PT-2026-89695

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

MiracleLinux 8 : curl-7.61.1-34.el8_10.13.ML.1 (AXSA:2026-1729:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1729:06 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of RHEL-73788. The .9...

RLSA-2026:57462 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

RockyLinux 8 : curl (RLSA-2026:57462)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57462 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of Rocky Linux-73788. The .9...

AlmaLinux 8 : curl (ALSA-2026:57462)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57462 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of AlmaLinux-73788. The .9...

RLSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

JLSEC-2026-1211 A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might...

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

CVE-2026-55990

A flaw was found in Unbound when configured with DNSCrypt support. An unauthenticated remote attacker could exploit a faulty configuration, where an imbalance between DNSCrypt provider certificate and secret key files leads to memory corruption. By sending a specially crafted network request, the...

CVE-2026-55990

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...

SUSE CVE-2026-8286

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...