Oracle Linux 10 : curl (ELSA-2026-55432)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55432 advisory. - fix proxy environment variable change detection CVE-2026-8927 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak...

PT-2026-73407

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

PT-2026-73397

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

curl security update

8.12.1-4.4 - fix proxy environment variable change detection CVE-2026-8927 8.12.1-4.el102.3 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak via redirect and netrc CVE-2026-3783 - fix proxy connection reuse with wrong credentials CVE-2026-3784...

curl: Fix of CVE-2026-8286

CVE-2026-8286: fix connection reuse for STARTTLS with mismatching TLS config...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-3063)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-3118)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...

JLSEC-2026-1217 libcurl would reuse a previously created connection even when some mTLS config related option had...

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...

JLSEC-2026-1204 libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid...

JLSEC-2026-1212 libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate...

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When...

JLSEC-2026-1211 A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might...

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...

JLSEC-2026-1205 libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl...

libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the...

curl: CVE-2026-19931: Negotiate ambient user conn reuse

Summary On Windows with SSPI/Negotiate, curl 8.21.0 can reuse a connection authenticated with ambient credentials for a later request using different explicit credentials. In urlmatchauthnego, the credential comparison is skipped when conn-creds == NULL. This allows a connection authenticated as...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2879)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...

CVE-2026-8458

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

AZL-94337 CVE-2026-56850 affecting package nodejs for versions less than 24.18.1-1

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...