CLSA-2026-1783341627
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1783341627.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1783341627
- Upstream
- Published
- 2026-07-06T12:40:46Z
- Modified
- 2026-10-26T09:31:47Z
- Summary
- Fix CVE(s): CVE-2026-8286, CVE-2026-8924, CVE-2026-8927
- Details
-
- SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a
mismatched TLS configuration.
- debian/patches/CVE-2026-8286.patch: add an SSL-config match check before reusing a connection for a clear-text protocol that requests TLS, in lib/url.c.
- CVE-2026-8286
- SECURITY UPDATE: a trailing-dot cookie domain could bypass the Public Suffix List
check and set a super-cookie.
- debian/patches/CVE-2026-8924.patch: trim trailing dots from the domains before the PSL check in lib/cookie.c.
- CVE-2026-8924
- SECURITY UPDATE: libcurl could send proxy Digest credentials to the wrong proxy when
the proxy is selected from environment variables on a reused handle.
- debian/patches/CVE-2026-8927.patch: clear the proxy Digest state when the environment proxy changes, in lib/url.c and lib/urldata.h.
- CVE-2026-8927
- SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a
mismatched TLS configuration.
- References