{"id":"CLSA-2026-1783341627","summary":"Fix CVE(s): CVE-2026-8286, CVE-2026-8924, CVE-2026-8927","details":"   * SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a\n     mismatched TLS configuration.\n     - debian/patches/CVE-2026-8286.patch: add an SSL-config match check before reusing a connection for a\n       clear-text protocol that requests TLS, in lib/url.c.\n     - CVE-2026-8286\n   * SECURITY UPDATE: a trailing-dot cookie domain could bypass the Public Suffix List\n     check and set a super-cookie.\n     - debian/patches/CVE-2026-8924.patch: trim trailing dots from the domains before the PSL check in\n       lib/cookie.c.\n     - CVE-2026-8924\n   * SECURITY UPDATE: libcurl could send proxy Digest credentials to the wrong proxy when\n     the proxy is selected from environment variables on a reused handle.\n     - debian/patches/CVE-2026-8927.patch: clear the proxy Digest state when the environment proxy changes, in\n       lib/url.c and lib/urldata.h.\n     - CVE-2026-8927","modified":"2026-10-26T09:31:47.117260500Z","published":"2026-07-06T12:40:46Z","upstream":["CVE-2026-8286","CVE-2026-8924","CVE-2026-8927"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1783341627.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927"}],"affected":[{"package":{"name":"curl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/curl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl3","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl3?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl3-gnutls","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl3-gnutls?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl3-nss","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl3-nss?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl4-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl4-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl4-gnutls-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl4-gnutls-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl4-nss-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl4-nss-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}},{"package":{"name":"libcurl4-openssl-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libcurl4-openssl-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.23+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json"}}],"schema_version":"1.9.0"}