Multiple CVEs Addressed in Oracle Linux curl Updates

Oracle has released important updates for its curl software, addressing multiple vulnerabilities. The updates include fixes for CVE-2026-1965 and CVE-2026-3783, which involve HTTP Negotiate connection reuse and OAuth2 bearer token leaks, respectively. Additionally, CVE-2026-9547 and CVE-2026-8286 are also addressed, targeting SSH host key mismatches and TLS connection reuse vulnerabilities. The vulnerabilities affect various versions of curl and libcurl across different architectures, including x86_64 and aarch64. System administrators are advised to apply these updates promptly to mitigate potential security risks. The updates were published on 2026-08-20, with previous CVEs disclosed earlier in 2026. These vulnerabilities could lead to unauthorized access and data leakage if not patched.

Key Points: • Oracle released critical updates for curl addressing multiple CVEs. • Vulnerabilities include OAuth2 token leaks and connection reuse issues. • System administrators must apply updates to prevent potential exploits.