AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789899988)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789899988 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handle...

OESA-2026-4127 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4126 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4128 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

OESA-2026-4125 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8820-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8820-1 advisory. Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication ...

USN-8820-1 curl vulnerabilities

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-13608 Stephan...

USN-8820-1: curl vulnerabilities

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-13608 Stephan...

CLSA-2026-1790154364 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899988 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899690 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899321 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CVE-2026-18924

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service. Mitigation Disable HTTP/2 Server Pu...

SUSE CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the cleanup process when handling HTTP/2 Server Push streams with the parenthandle configured to share connections with other handles. An attacker can execute arbitrary code or cause a denial of service by triggering...

AZL-99879 CVE-2026-18924 affecting package tensorflow 2.16.1-11

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99780 CVE-2026-18924 affecting package cmake 3.30.3-15

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99858 CVE-2026-18924 affecting package rust 1.90.0-10

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...