{"id":"CLSA-2026-1786119141","summary":"Fix of 5 CVEs","details":"   * SECURITY UPDATE: stale custom cookie host causes cookie leak\n     - debian/patches/CVE-2026-6276.patch: clear the remembered custom\n       Host: name at the start of every request in lib/http.c.\n     - CVE-2026-6276\n   * SECURITY UPDATE: wrong STARTTLS connection reuse\n     - debian/patches/CVE-2026-8286.patch: require a matching SSL\n       configuration when reusing a connection for a transfer that may\n       upgrade to TLS in lib/url.c.\n     - CVE-2026-8286\n   * SECURITY UPDATE: env-set cross-proxy Digest auth state leak\n     - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state\n       when the proxy read from the environment changes in lib/url.c,\n       lib/urldata.h.\n     - CVE-2026-8927\n   * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS\n     session cache\n     - debian/patches/CVE-2026-8932.patch: include the client private key\n       options in the primary SSL config so connection reuse and the TLS\n       session cache compare them in lib/url.c, lib/urldata.h,\n       lib/vtls/vtls.c.\n     - CVE-2026-8932\n   * SECURITY UPDATE: HTTP/2 push headers memory leak\n     - debian/patches/CVE-2024-2398.patch: free the whole set of push\n       headers on the array-growth failure path in lib/http2.c.\n     - CVE-2024-2398","modified":"2026-10-26T09:43:32.943516823Z","published":"2026-08-13T02:39:13Z","upstream":["CVE-2024-2398","CVE-2026-6276","CVE-2026-8286","CVE-2026-8927","CVE-2026-8932"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786119141.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932"}],"affected":[{"package":{"name":"curl","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/curl?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl3-gnutls","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl3-gnutls?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl3-nss","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl3-nss?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl4","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl4-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl4-gnutls-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-gnutls-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl4-nss-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-nss-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}},{"package":{"name":"libcurl4-openssl-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libcurl4-openssl-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u9+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786119141.json"}}],"schema_version":"1.9.0"}