{"id":"CLSA-2026-1789899321","summary":"curl: Fix of 3 CVEs","details":"- CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push\n  transfers, because a pushed transfer did not inherit the parent handle's\n  share and could therefore outlive a shared connection\n- CVE-2026-80230: public key pinning was not enforced when the server\n  presented no certificate and both peer and host verification were\n  disabled, so an unauthenticated connection succeeded where it should have\n  been rejected\n- CVE-2026-82209: a cookie whose Domain attribute exactly matched a public\n  suffix was stored with wildcard domain scope instead of being coerced to\n  host-only, so it was sent to arbitrary sibling subdomains under that\n  public suffix","modified":"2026-10-26T09:31:43.857678471Z","published":"2026-09-20T10:15:34Z","upstream":["CVE-2026-18924","CVE-2026-80230","CVE-2026-82209"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1789899321.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209"}],"affected":[{"package":{"name":"curl","ecosystem":"TuxCare:CentOS:8.4","purl":"pkg:rpm/tuxcare/curl?distro=centos-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"}},{"package":{"name":"curl-minimal","ecosystem":"TuxCare:CentOS:8.4","purl":"pkg:rpm/tuxcare/curl-minimal?distro=centos-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"}},{"package":{"name":"libcurl","ecosystem":"TuxCare:CentOS:8.4","purl":"pkg:rpm/tuxcare/libcurl?distro=centos-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"}},{"package":{"name":"libcurl-devel","ecosystem":"TuxCare:CentOS:8.4","purl":"pkg:rpm/tuxcare/libcurl-devel?distro=centos-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"}},{"package":{"name":"libcurl-minimal","ecosystem":"TuxCare:CentOS:8.4","purl":"pkg:rpm/tuxcare/libcurl-minimal?distro=centos-8.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.4els/CLSA-2026-1789899321.json"}}],"schema_version":"1.9.0"}