{"schema_version":"1.7.2","id":"OESA-2026-2987","modified":"2026-07-19T03:46:58Z","published":"2026-07-19T03:46:58Z","upstream":["CVE-2026-10536","CVE-2026-12064","CVE-2026-8286","CVE-2026-8924","CVE-2026-8927","CVE-2026-9547"],"summary":"curl security update","details":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.(CVE-2026-10536)\n\nWhen a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.(CVE-2026-12064)\n\nA vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.(CVE-2026-8286)\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n'super cookies' that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.(CVE-2026-8924)\n\nWhen reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.(CVE-2026-8927)\n\nWhen a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"curl","purl":"pkg:rpm/openEuler/curl&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-32.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["curl-8.4.0-32.oe2403sp3.aarch64.rpm","curl-debuginfo-8.4.0-32.oe2403sp3.aarch64.rpm","curl-debugsource-8.4.0-32.oe2403sp3.aarch64.rpm","libcurl-8.4.0-32.oe2403sp3.aarch64.rpm","libcurl-devel-8.4.0-32.oe2403sp3.aarch64.rpm"],"noarch":["curl-help-8.4.0-32.oe2403sp3.noarch.rpm"],"src":["curl-8.4.0-32.oe2403sp3.src.rpm"],"x86_64":["curl-8.4.0-32.oe2403sp3.x86_64.rpm","curl-debuginfo-8.4.0-32.oe2403sp3.x86_64.rpm","curl-debugsource-8.4.0-32.oe2403sp3.x86_64.rpm","libcurl-8.4.0-32.oe2403sp3.x86_64.rpm","libcurl-devel-8.4.0-32.oe2403sp3.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2987"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547"}],"database_specific":{"severity":"High"}}