UnratedFix available
curl: Fix of 2 CVEs
Type: advisorySources: OSV
- CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service - CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
- Products
- curl, curl-minimal, libcurl, libcurl-devel, libcurl-minimal
- Affected versions
- Not specified
- Fixed versions
- 7.76.1-31.el9_2.1.tuxcare.els18
- CVEs
- CVE-2026-8458, CVE-2026-8926
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 10:43 UTC · Revision 1
Source evidence
- CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service - CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup
osv:CLSA-2026-1786094315
curl
Fixed versions: 7.76.1-31.el9_2.1.tuxcare.els18
curl-minimal
Fixed versions: 7.76.1-31.el9_2.1.tuxcare.els18
libcurl
Fixed versions: 7.76.1-31.el9_2.1.tuxcare.els18
libcurl-devel
Fixed versions: 7.76.1-31.el9_2.1.tuxcare.els18
libcurl-minimal
Fixed versions: 7.76.1-31.el9_2.1.tuxcare.els18
Complete source record
{
"id": "1296287ae1cafae99875735208fec3234b8e81fee381c13f17a994be59a7a4d6",
"url": "https://osv.dev/vulnerability/CLSA-2026-1786094315",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "curl: Fix of 2 CVEs",
"summary": "- CVE-2026-8458: tie the requested SASL/SPNEGO service name to the connection and compare it when matching an existing connection for reuse, so a Negotiate authenticated connection is not reused for a transfer that asked for a different service - CVE-2026-8926: discard a .netrc entry that matches the host but whose login does not match the user given in the URL, so the password that belongs to another user of that host is no longer returned as a successful lookup",
"evidence": "osv:CLSA-2026-1786094315",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.76.1-31.el9_2.1.tuxcare.els18",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl-minimal",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.76.1-31.el9_2.1.tuxcare.els18",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.76.1-31.el9_2.1.tuxcare.els18",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl-devel",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.76.1-31.el9_2.1.tuxcare.els18",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libcurl-minimal",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.76.1-31.el9_2.1.tuxcare.els18",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1786094315",
"aliases": [
"CLSA-2026-1786094315"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.76.1-31.el9_2.1.tuxcare.els18"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:rpm/tuxcare/curl?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786094315.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.76.1-31.el9_2.1.tuxcare.els18"
}
]
}
],
"package": {
"name": "curl-minimal",
"purl": "pkg:rpm/tuxcare/curl-minimal?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786094315.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.76.1-31.el9_2.1.tuxcare.els18"
}
]
}
],
"package": {
"name": "libcurl",
"purl": "pkg:rpm/tuxcare/libcurl?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786094315.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.76.1-31.el9_2.1.tuxcare.els18"
}
]
}
],
"package": {
"name": "libcurl-devel",
"purl": "pkg:rpm/tuxcare/libcurl-devel?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786094315.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.76.1-31.el9_2.1.tuxcare.els18"
}
]
}
],
"package": {
"name": "libcurl-minimal",
"purl": "pkg:rpm/tuxcare/libcurl-minimal?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786094315.json"
}
}
],
"modified": "2026-10-26T09:30:31.728017122Z",
"provider": "osv",
"upstream": [
"CVE-2026-8458",
"CVE-2026-8926"
],
"references": [
"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786094315.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8458",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8926"
]
},
"related_cves": [
{
"value": "CVE-2026-8458",
"evidence": "/upstream"
},
{
"value": "CVE-2026-8926",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 447108,
"published_at": "2026-08-07T09:18:46+00:00"
}