RHSA-2026:6893
Vulnerability from csaf_redhat - Published: 2026-04-07 15:43 - Updated: 2026-04-19 19:37Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
curl:
* curl-8.19.0-3.hum1 (aarch64, x86_64)
* libcurl-8.19.0-3.hum1 (aarch64, x86_64)
* libcurl-devel-8.19.0-3.hum1 (aarch64, x86_64)
* libcurl-minimal-8.19.0-3.hum1 (aarch64, x86_64)
* curl-8.19.0-3.hum1.src (source)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
5.3 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server's malicious content and serves it to all users of that proxy.
4.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. As the wolfSSH backend was documented as incomplete and fail tests, it is not expected that many users execute this code in production.
5.9 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server's identity.
6.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
To mitigate this issue, ensure that standard certificate verification is not explicitly disabled when utilizing `CURLOPT_PINNEDPUBLICKEY` or `--pinnedpubkey` with curl. This practice prevents the bypass of the pinned public key check, particularly in configurations involving QUIC and `ngtcp2` built with GnuTLS. Always verify server certificates through standard means to maintain secure connections.
A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.
4.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.
6.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks.
8.1 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
To mitigate this issue, ensure that the system-wide `libssh` global knownhosts file (`/etc/ssh/ssh_known_hosts`) does not contain entries for untrusted hosts. Alternatively, avoid using `libcurl` for SCP or SFTP transfers in environments where strict enforcement of a user-specified knownhosts file is critical and the system-wide knownhosts file cannot be fully controlled. Services relying on `libssh` for host key verification may need to be restarted to apply the changes.
A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
4.7 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.
6.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.
5.7 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.
A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A flaw was found in curl. When handling a second Server Message Block (SMB) request to the same host, curl incorrectly accesses memory that has already been freed. This memory corruption vulnerability, known as a use-after-free, could allow a remote attacker to potentially execute arbitrary code or cause a denial of service.
6.3 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6893
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ncurl:\n * curl-8.19.0-3.hum1 (aarch64, x86_64)\n * libcurl-8.19.0-3.hum1 (aarch64, x86_64)\n * libcurl-devel-8.19.0-3.hum1 (aarch64, x86_64)\n * libcurl-minimal-8.19.0-3.hum1 (aarch64, x86_64)\n * curl-8.19.0-3.hum1.src (source)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6893",
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-9086",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-10148",
"url": "https://access.redhat.com/security/cve/CVE-2025-10148"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-10966",
"url": "https://access.redhat.com/security/cve/CVE-2025-10966"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15224",
"url": "https://access.redhat.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15079",
"url": "https://access.redhat.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14819",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14524",
"url": "https://access.redhat.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13034",
"url": "https://access.redhat.com/security/cve/CVE-2025-13034"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3805",
"url": "https://access.redhat.com/security/cve/CVE-2026-3805"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3783",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3784",
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1965",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14017",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-04-19T19:37:47+00:00",
"generator": {
"date": "2026-04-19T19:37:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2026:6893",
"initial_release_date": "2026-04-07T15:43:21+00:00",
"revision_history": [
{
"date": "2026-04-07T15:43:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-18T20:01:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-19T19:37:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-main@aarch64",
"product": {
"name": "curl-main@aarch64",
"product_id": "curl-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.19.0-3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-main@src",
"product": {
"name": "curl-main@src",
"product_id": "curl-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.19.0-3.hum1?arch=source\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-main@x86_64",
"product": {
"name": "curl-main@x86_64",
"product_id": "curl-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/curl@8.19.0-3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-main@aarch64"
},
"product_reference": "curl-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-main@src"
},
"product_reference": "curl-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:curl-main@x86_64"
},
"product_reference": "curl-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9086",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-09-12T06:01:02.244669+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2394750"
}
],
"notes": [
{
"category": "description",
"text": "An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Curl out of bounds read for cookie path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9086"
},
{
"category": "external",
"summary": "RHBZ#2394750",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394750"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.html",
"url": "https://curl.se/docs/CVE-2025-9086.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-9086.json",
"url": "https://curl.se/docs/CVE-2025-9086.json"
},
{
"category": "external",
"summary": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6",
"url": "https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3294999",
"url": "https://hackerone.com/reports/3294999"
}
],
"release_date": "2025-09-12T05:10:03.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: libcurl: Curl out of bounds read for cookie path"
},
{
"cve": "CVE-2025-10148",
"cwe": {
"id": "CWE-340",
"name": "Generation of Predictable Numbers or Identifiers"
},
"discovery_date": "2025-09-12T06:00:58.790751+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2394749"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. The use of a predictable WebSocket mask pattern allows a malicious server to induce traffic that an intermediary proxy (whether configured or transparent) will misinterpret as a standard HTTP request. This confusion leads to a cache poisoning attack, where the proxy stores the server\u0027s malicious content and serves it to all users of that proxy.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: predictable WebSocket mask",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, a curl application must be communicating through a defective proxy that confuses a WebSocket for HTTP traffic. Additionally, this flaw requires the traffic to be done using clear text HTTP / WebSocket (ws://) and not over TLS (wss://).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10148"
},
{
"category": "external",
"summary": "RHBZ#2394749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394749"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10148",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10148"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10148",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10148"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-10148.html",
"url": "https://curl.se/docs/CVE-2025-10148.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-10148.json",
"url": "https://curl.se/docs/CVE-2025-10148.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3330839",
"url": "https://hackerone.com/reports/3330839"
}
],
"release_date": "2025-09-12T05:10:37.469000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: predictable WebSocket mask"
},
{
"cve": "CVE-2025-10966",
"cwe": {
"id": "CWE-322",
"name": "Key Exchange without Entity Authentication"
},
"discovery_date": "2025-11-07T08:00:51.044355+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2413308"
}
],
"notes": [
{
"category": "description",
"text": "curl\u0027s code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. As the wolfSSH backend was documented as incomplete and fail tests, it is not expected that many users execute this code in production.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Curl missing SFTP host verification with wolfSSH backend",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability doesn\u0027t affect any supported Red Hat product. This flaw affects only curl when built with wolfSSH backend support, meanwhile for Red Hat Enterprise Linux and other Red Hat products the default SSH backend being use is libssh. It\u0027s not possible to change this configuration in runtime, as it\u0027s a build time only configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10966"
},
{
"category": "external",
"summary": "RHBZ#2413308",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413308"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10966"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2025/11/05/2",
"url": "http://www.openwall.com/lists/oss-security/2025/11/05/2"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-10966.html",
"url": "https://curl.se/docs/CVE-2025-10966.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-10966.json",
"url": "https://curl.se/docs/CVE-2025-10966.json"
},
{
"category": "external",
"summary": "https://github.com/curl/curl/commit/b011e3fcfb06d6c027859",
"url": "https://github.com/curl/curl/commit/b011e3fcfb06d6c027859"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3355218",
"url": "https://hackerone.com/reports/3355218"
}
],
"release_date": "2025-11-07T07:26:30.351000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: Curl missing SFTP host verification with wolfSSH backend"
},
{
"cve": "CVE-2025-13034",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2025-12-31T03:46:57.230000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426406"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one, potentially leading to unauthorized access or information disclosure due to a failure in verifying the server\u0027s identity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat products. The flaw in curl occurs only when using `CURLOPT_PINNEDPUBLICKEY` with QUIC and ngtcp2 built with GnuTLS, and when standard certificate verification is explicitly disabled. This specific combination of features and configuration is uncommon in Red Hat deployments, limiting the overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13034"
},
{
"category": "external",
"summary": "RHBZ#2426406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426406"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that standard certificate verification is not explicitly disabled when utilizing `CURLOPT_PINNEDPUBLICKEY` or `--pinnedpubkey` with curl. This practice prevents the bypass of the pinned public key check, particularly in configurations involving QUIC and `ngtcp2` built with GnuTLS. Always verify server certificates through standard means to maintain secure connections.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation"
},
{
"cve": "CVE-2025-14017",
"cwe": {
"id": "CWE-1058",
"name": "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element"
},
"discovery_date": "2026-01-08T11:01:16.184214+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When performing multi-threaded LDAPS (Lightweight Directory Access Protocol Secure) transfers, changes to Transport Layer Security (TLS) options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security posture changes, such as disabling certificate verification for other threads. This vulnerability can result in a security bypass, where expected security checks are not performed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. The flaw in curl affects multi-threaded LDAPS transfers where changes to TLS options in one thread could inadvertently apply globally, impacting other concurrent transfers. This could lead to a security bypass if an application relies on specific TLS settings that are then overridden. Impact is limited to applications utilizing libcurl for multi-threaded LDAPS connections that dynamically modify TLS options.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "RHBZ#2427870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.html",
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2025-14017.json",
"url": "https://curl.se/docs/CVE-2025-14017.json"
}
],
"release_date": "2026-01-08T10:07:05.554000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers"
},
{
"cve": "CVE-2025-14524",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2025-12-31T03:46:56.325000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an OAuth2 (Open Authorization) bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a different scheme like IMAP, LDAP, POP3, or SMTP, curl might incorrectly pass the bearer token to the new target host. This could lead to information disclosure, where sensitive authentication tokens are exposed to unintended recipients.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat because `curl` might inadvertently pass an OAuth2 bearer token during a cross-protocol redirect from HTTP(S) to IMAP, LDAP, POP3, or SMTP schemes. This could lead to unintended information disclosure if applications using `curl` are configured to perform such redirects with bearer tokens.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "RHBZ#2426407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token"
},
{
"cve": "CVE-2025-14819",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2025-12-31T03:46:56.325000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When handling secure connections (TLS) and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server\u0027s security certificate that it should have otherwise rejected, potentially compromising the integrity of the secure connection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat because `libcurl` could incorrectly reuse a cached CA store when applications alter the `CURLSSLOPT_NO_PARTIALCHAIN` option with re-used easy or multi handles. This could lead to the acceptance of an otherwise untrusted TLS trust chain. Exploitation requires specific application logic that dynamically changes this option while reusing `libcurl` handles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "RHBZ#2426408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14819"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: libcurl: Improper certificate validation due to cached TLS settings reuse"
},
{
"cve": "CVE-2025-15079",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2025-12-31T03:46:56.768000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Host verification bypass during SSH transfers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat because libcurl, when configured for SSH-based transfers (SCP/SFTP) with a user-specified knownhosts file, may bypass this configuration and accept connections to hosts present in the system-wide libssh global knownhosts file. This could lead to unintended host trust in specific deployment scenarios.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "RHBZ#2426409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the system-wide `libssh` global knownhosts file (`/etc/ssh/ssh_known_hosts`) does not contain entries for untrusted hosts. Alternatively, avoid using `libcurl` for SCP or SFTP transfers in environments where strict enforcement of a user-specified knownhosts file is critical and the system-wide knownhosts file cannot be fully controlled. Services relying on `libssh` for host key verification may need to be restarted to apply the changes.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: Host verification bypass during SSH transfers"
},
{
"cve": "CVE-2025-15224",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2025-12-31T03:58:07.013000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2426410"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libssh key passphrase bypass without agent set",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat products. The flaw in libcurl, when built with the libssh backend, allows it to wrongly attempt authentication via a locally running SSH agent during public key authentication for SCP or SFTP transfers. However, successful authentication still requires the SSH agent to possess the correct passphrase.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "RHBZ#2426410",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426410"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224"
}
],
"release_date": "2026-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: libssh key passphrase bypass without agent set"
},
{
"cve": "CVE-2026-1965",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-03-11T11:00:54.752485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "RHBZ#2446448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.html",
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.json",
"url": "https://curl.se/docs/CVE-2026-1965.json"
}
],
"release_date": "2026-03-11T10:08:52.431000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication"
},
{
"cve": "CVE-2026-3783",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-03-11T11:01:01.429907+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "RHBZ#2446450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/2",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.html",
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.json",
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3583983",
"url": "https://hackerone.com/reports/3583983"
}
],
"release_date": "2026-03-11T10:09:08.746000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect"
},
{
"cve": "CVE-2026-3784",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-03-11T11:00:57.752827+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446449"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker gaining unauthorized access to resources or information intended for a different user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"category": "external",
"summary": "RHBZ#2446449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446449"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/3",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3784.html",
"url": "https://curl.se/docs/CVE-2026-3784.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3784.json",
"url": "https://curl.se/docs/CVE-2026-3784.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3584903",
"url": "https://hackerone.com/reports/3584903"
}
],
"release_date": "2026-03-11T10:09:21.418000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Unauthorized access due to improper HTTP proxy connection reuse"
},
{
"cve": "CVE-2026-3805",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-11T11:01:04.465150+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446451"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When handling a second Server Message Block (SMB) request to the same host, curl incorrectly accesses memory that has already been freed. This memory corruption vulnerability, known as a use-after-free, could allow a remote attacker to potentially execute arbitrary code or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3805"
},
{
"category": "external",
"summary": "RHBZ#2446451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3805"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/4",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/4"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3805.html",
"url": "https://curl.se/docs/CVE-2026-3805.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3805.json",
"url": "https://curl.se/docs/CVE-2026-3805.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3591944",
"url": "https://hackerone.com/reports/3591944"
}
],
"release_date": "2026-03-11T10:09:37.729000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T15:43:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6893"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:curl-main@aarch64",
"Red Hat Hardened Images:curl-main@src",
"Red Hat Hardened Images:curl-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…