Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat curl packages could let attackers modify data

published 21 days ago

Summary

The curl and related libcurl packages for Red Hat can be tricked into handling data incorrectly, which could let an attacker change or corrupt information. This risk is addressed by a software update that corrects the code and adds extra safety checks. Install the latest Red Hat update for these packages as soon as possible.

What to do

Update redhat curl to version 0:8.22.0-1.1.hum1.
Update redhat libcurl to version 0:8.22.0-1.1.hum1.
Update redhat libcurl-devel to version 0:8.22.0-1.1.hum1.
Update redhat libcurl-minimal to version 0:8.22.0-1.1.hum1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:hummingbird:1	redhat	curl	< 0:8.22.0-1.1.hum1 Fix: upgrade to 0:8.22.0-1.1.hum1
Red Hat:hummingbird:1	redhat	libcurl	< 0:8.22.0-1.1.hum1 Fix: upgrade to 0:8.22.0-1.1.hum1
Red Hat:hummingbird:1	redhat	libcurl-devel	< 0:8.22.0-1.1.hum1 Fix: upgrade to 0:8.22.0-1.1.hum1
Red Hat:hummingbird:1	redhat	libcurl-minimal	< 0:8.22.0-1.1.hum1 Fix: upgrade to 0:8.22.0-1.1.hum1

Original advisory text

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

References

https://access.redhat.com/errata/RHSA-2026:77255 Vendor Advisory
https://images.redhat.com/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-9086 Third Party Advisory
https://access.redhat.com/security/updates/classification/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-14819 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-3783 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-3784 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-1965 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-14017 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77255.... Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2394750 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-9086 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-9086 Vendor Advisory
https://curl.se/docs/CVE-2025-9086.html Third Party Advisory
https://curl.se/docs/CVE-2025-9086.json Third Party Advisory
https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6 Third Party Advisory
https://hackerone.com/reports/3294999 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2427870 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-14017 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14017 Vendor Advisory
https://curl.se/docs/CVE-2025-14017.html Third Party Advisory
https://curl.se/docs/CVE-2025-14017.json Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2426408 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-14819 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14819 Vendor Advisory
https://curl.se/docs/CVE-2025-14819.html Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2446448 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-1965 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1965 Vendor Advisory
https://curl.se/docs/CVE-2026-1965.html Third Party Advisory
https://curl.se/docs/CVE-2026-1965.json Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2446450 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-3783 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3783 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/11/2 Third Party Advisory
https://curl.se/docs/CVE-2026-3783.html Third Party Advisory
https://curl.se/docs/CVE-2026-3783.json Third Party Advisory
https://hackerone.com/reports/3583983 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2446449 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-3784 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3784 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/11/3 Third Party Advisory
https://curl.se/docs/CVE-2026-3784.html Third Party Advisory
https://curl.se/docs/CVE-2026-3784.json Third Party Advisory
https://hackerone.com/reports/3584903 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.8 Medium

Timeline

Published14 Oct 2026

Updated14 Oct 2026

First seen14 Oct 2026

Sources

RHSA-2026:77255 · OSV

Track software like this

Free during beta