CLSA-2026-1785847606
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1785847606.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1785847606
- Upstream
- Published
- 2026-08-04T12:47:00Z
- Modified
- 2026-10-26T09:30:31Z
- Summary
- curl: Fix of 4 CVEs
- Details
-
- CVE-2026-4873: do not reuse a clear-text STARTTLS connection when the new transfer requires TLS, so an IMAP, SMTP or POP3 request that mandates TLS is not sent over an unencrypted connection
- CVE-2026-6253: restore the proxy credentials set via options on every redirect so credentials belonging to the first proxy are not disclosed to a second, different proxy
- CVE-2026-6429: drop credentials that were not set through CURLOPT_USERNAME on redirect so a netrc password established for the first host is not sent to the redirect target over a reused connection or proxy
- CVE-2026-8924: trim trailing dots from the request and cookie domains before the public suffix list check so a trailing-dot domain cannot set a super cookie scoped to an unrelated site
- References