curl: Fix of 3 CVEs
- CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected - CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix
- Products
- curl, curl-minimal, libcurl, libcurl-devel, libcurl-minimal
- Affected versions
- Not specified
- Fixed versions
- 7.61.1-22.el8.tuxcare.els23
- CVEs
- CVE-2026-18924, CVE-2026-80230, CVE-2026-82209
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:04 UTC · Revision 1
Source evidence
- CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected - CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix
osv:CLSA-2026-1789899321
curl
Fixed versions: 7.61.1-22.el8.tuxcare.els23
curl-minimal
Fixed versions: 7.61.1-22.el8.tuxcare.els23
libcurl
Fixed versions: 7.61.1-22.el8.tuxcare.els23
libcurl-devel
Fixed versions: 7.61.1-22.el8.tuxcare.els23
libcurl-minimal
Fixed versions: 7.61.1-22.el8.tuxcare.els23
Complete source record
{
"id": "65bf85e692753151425f6c7117802147b00673544a90dad5dd12a877b1191d3b",
"url": "https://osv.dev/vulnerability/CLSA-2026-1789899321",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "curl: Fix of 3 CVEs",
"summary": "- CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected - CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix",
"evidence": "osv:CLSA-2026-1789899321",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.61.1-22.el8.tuxcare.els23",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl-minimal",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.61.1-22.el8.tuxcare.els23",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.61.1-22.el8.tuxcare.els23",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl-devel",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.61.1-22.el8.tuxcare.els23",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl-minimal",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.61.1-22.el8.tuxcare.els23",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1789899321",
"aliases": [
"CLSA-2026-1789899321"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.61.1-22.el8.tuxcare.els23"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:rpm/tuxcare/curl?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.61.1-22.el8.tuxcare.els23"
}
]
}
],
"package": {
"name": "curl-minimal",
"purl": "pkg:rpm/tuxcare/curl-minimal?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.61.1-22.el8.tuxcare.els23"
}
]
}
],
"package": {
"name": "libcurl",
"purl": "pkg:rpm/tuxcare/libcurl?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.61.1-22.el8.tuxcare.els23"
}
]
}
],
"package": {
"name": "libcurl-devel",
"purl": "pkg:rpm/tuxcare/libcurl-devel?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.61.1-22.el8.tuxcare.els23"
}
]
}
],
"package": {
"name": "libcurl-minimal",
"purl": "pkg:rpm/tuxcare/libcurl-minimal?distro=centos-8.4",
"ecosystem": "TuxCare:CentOS:8.4"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"
}
}
],
"modified": "2026-10-26T09:31:43.857678471Z",
"provider": "osv",
"upstream": [
"CVE-2026-18924",
"CVE-2026-80230",
"CVE-2026-82209"
],
"references": [
"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1789899321.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-18924",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80230",
"https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
]
},
"related_cves": [
{
"value": "CVE-2026-18924",
"evidence": "/upstream"
},
{
"value": "CVE-2026-80230",
"evidence": "/upstream"
},
{
"value": "CVE-2026-82209",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448280,
"published_at": "2026-09-20T10:15:34+00:00"
}