Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2022_5313)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225313 advisory. curl: OAUTH2 bearer bypass in connection re-use CVE-2022-22576 curl: credential leak on redirect CVE-2022-27774 curl: auth/cookie leak on redirect...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2024:1712672178)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1712672178 advisory. - When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maxim...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS7:CLSA-2026:1785400806)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1785400806 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.5:CLSA-2026:1767807099)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1767807099 advisory. - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same...

Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261401 advisory. This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.6. It addresses 23 CVEs: CVE-2024-11053, CVE-2023-46218, CVE-2023-28322,...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2022_6159)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226159 advisory. curl: HTTP compression denial of service CVE-2022-32206 curl: FTP-KRB bad message verification CVE-2022-32208 Tenable has extracted the preceding descripti...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.4:CLSA-2026:1767808644)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767808644 advisory. - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786091577)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786091577 advisory. - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1783703539)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783703539 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1774276586)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1774276586 advisory. - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for th...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2025:1764773365)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764773365 advisory. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or late...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc (crlsa-2023_1140)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231140 advisory. curl: HTTP multi-header compression denial of service CVE-2023-23916 Tenable has extracted the preceding description block directly from the CIQ security advisory...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1773134717)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773134717 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL th...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1783703539)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783703539 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1771501913)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771501913 advisory. - When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connectin...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1773153207)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1773153207 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785499004)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785499004 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787062885)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787062885 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1773135327)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1773135327 advisory. - When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL th...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1786464575)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1786464575 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...