Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux curl can leak credentials or cause crashes
published 24 days ago
Summary
The curl and libcurl packages on AlmaLinux may expose proxy or authentication credentials during redirects and could also crash the system, leading to a denial of service. This risk affects the curl, libcurl, libcurl-devel, and libcurl-minimal packages. Apply the latest security updates for these packages as soon as possible.
What to do
- Update almalinux curl to version 8.12.1-4.el10_2.7.
- Update almalinux libcurl to version 8.12.1-4.el10_2.7.
- Update almalinux libcurl-devel to version 8.12.1-4.el10_2.7.
- Update almalinux libcurl-minimal to version 8.12.1-4.el10_2.7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | curl |
< 8.12.1-4.el10_2.7 Fix: upgrade to 8.12.1-4.el10_2.7
|
| AlmaLinux:10 | almalinux | libcurl |
< 8.12.1-4.el10_2.7 Fix: upgrade to 8.12.1-4.el10_2.7
|
| AlmaLinux:10 | almalinux | libcurl-devel |
< 8.12.1-4.el10_2.7 Fix: upgrade to 8.12.1-4.el10_2.7
|
| AlmaLinux:10 | almalinux | libcurl-minimal |
< 8.12.1-4.el10_2.7 Fix: upgrade to 8.12.1-4.el10_2.7
|
Original advisory text
Moderate: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)
* curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)
* curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)
* curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)
* libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies (CVE-2026-6253)
* curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse (CVE-2026-5545)
* curl: libcurl: Credential leak via reused proxy connection during HTTP redirects (CVE-2026-6429)
* curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse (CVE-2026-7168)
* libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service (CVE-2026-10536)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:80512 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-10536 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-5545 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-6253 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-6429 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-7168 Third Party Advisory
- https://bugzilla.redhat.com/2461202 Third Party Advisory
- https://bugzilla.redhat.com/2461204 Third Party Advisory
- https://bugzilla.redhat.com/2461205 Third Party Advisory
- https://bugzilla.redhat.com/2476979 Third Party Advisory
- https://bugzilla.redhat.com/2496766 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-80512.html Vendor Advisory
Timeline
Published12 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
ALSA-2026:80512 · OSV
Track software like this
Free during beta