Back Linuxsecurity

Oracle Linux curl Important Fix ELSA-2026-55432 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • August 18, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

[8.12.1-4.4] - fix proxy environment variable change detection (CVE-2026-8927) [8.12.1-4.el10_2.3] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - fix proxy connection reuse with wrong credentials (CVE-2026-3784) [8.12.1-4.2] - fix SSH host key mismatch on type difference (CVE-2026-9547) - fix schemeless URL handling with --proto-default (CVE-2026-12064) - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) [8.12.1-4.1] - openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)

curl-8.12.1-4.el10_2.4.x86_64.rpm libcurl-8.12.1-4.el10_2.4.x86_64.rpm libcurl-devel-8.12.1-4.el10_2.4.x86_64.rpm libcurl-minimal-8.12.1-4.el10_2.4.x86_64.rpm

curl-8.12.1-4.el10_2.4.aarch64.rpm libcurl-8.12.1-4.el10_2.4.aarch64.rpm libcurl-devel-8.12.1-4.el10_2.4.aarch64.rpm libcurl-minimal-8.12.1-4.el10_2.4.aarch64.rpm

Related CVEs: CVE-2026-8927

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in Oracle Linux curl Updates Oracle has released important updates for its curl software, addressing multiple vulnerabilities. The updates include fixes for CVE-2026-1965 and CVE-2026-3783, which involve HTTP Negotiate connection reuse and OAuth2 bearer token leaks, respectively. Additionally, CVE-2026-9547 and CVE-2026-8286 are also addressed, targeting SSH host key mismatches and TLS connection reuse vulnerabilities. The vulnerabilities affect various versions of curl and libcurl across different architectures, including x86_64 and aarch64. System administrators are advised to apply these updates promptly to mitigate potential security risks. The updates were published on 2026-08-20, with previous CVEs disclosed earlier in 2026. These vulnerabilities could lead to unauthorized access and data leakage if not patched. 4 sources 73

Extracted Entities

CVEs (8)

CVE-2025-14819 CVE-2026-12064 CVE-2026-1965 CVE-2026-3783 CVE-2026-3784 CVE-2026-8286 CVE-2026-8927 CVE-2026-9547

CWE Weaknesses (2)

CWE-200 - Exposure of Sensitive Information CWE-287 - Improper Authentication