{"id":"CLSA-2026-1785847606","summary":"curl: Fix of 4 CVEs","details":"- CVE-2026-4873: do not reuse a clear-text STARTTLS connection when the new\n  transfer requires TLS, so an IMAP, SMTP or POP3 request that mandates TLS is\n  not sent over an unencrypted connection\n- CVE-2026-6253: restore the proxy credentials set via options on every\n  redirect so credentials belonging to the first proxy are not disclosed to a\n  second, different proxy\n- CVE-2026-6429: drop credentials that were not set through CURLOPT_USERNAME\n  on redirect so a netrc password established for the first host is not sent to\n  the redirect target over a reused connection or proxy\n- CVE-2026-8924: trim trailing dots from the request and cookie domains before\n  the public suffix list check so a trailing-dot domain cannot set a super\n  cookie scoped to an unrelated site","modified":"2026-10-26T09:30:31.727226847Z","published":"2026-08-04T12:47:00Z","upstream":["CVE-2026-4873","CVE-2026-6253","CVE-2026-6429","CVE-2026-8924"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785847606.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924"}],"affected":[{"package":{"name":"curl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/curl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json"}},{"package":{"name":"curl-minimal","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/curl-minimal?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json"}},{"package":{"name":"libcurl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/libcurl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json"}},{"package":{"name":"libcurl-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/libcurl-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json"}},{"package":{"name":"libcurl-minimal","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/libcurl-minimal?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_2.1.tuxcare.els16"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json"}}],"schema_version":"1.9.0"}