[CLSA-2026:1790236735] Fix CVE(s): CVE-2026-8286, CVE-2026-8458
Type:
security
Severity:
Important
Release date:
2026-09-24 07:59:07 UTC
Description:
* SECURITY UPDATE: connection reuse with a mismatching TLS configuration for STARTTLS protocols - debian/patches/CVE-2026-8286.patch: also require a matching SSL configuration when looking for a connection to reuse for a transfer that may upgrade to TLS from a clear-text start in lib/url.c - CVE-2026-8286 * SECURITY UPDATE: connection reuse across different GSS-API service names - debian/patches/CVE-2026-8458.patch: keep the service name and the proxy service name on the connection and compare them when looking for a connection to reuse in lib/urldata.h, lib/url.c and lib/http_negotiate.c - CVE-2026-8458
CVEs fixed:
Updated packages:
  • curl_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:3cf36941fc04840f98f34a460ed3ce1a3a9ac15e
  • libcurl3-gnutls_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:f7ea67fe8a557b18c533698a1fc8d8f2e06b6c5a
  • libcurl3-nss_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:8573d36499806ef4ea98cd631659162b62dc81f3
  • libcurl4_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:3376a0dc9459b976df0d02784fe0b6d1d69f367b
  • libcurl4-doc_7.68.0-1ubuntu2.25+tuxcare.els6_all.deb
    sha:7717408af0d444a8daeee1de778575f9373b7298
  • libcurl4-gnutls-dev_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:a1ddebeb9e0426cf01e37ecee2140f385f6d9668
  • libcurl4-nss-dev_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:099041bca9e30826eed2308461849f4407e4156f
  • libcurl4-openssl-dev_7.68.0-1ubuntu2.25+tuxcare.els6_amd64.deb
    sha:c2f307b1111e22933200b2683c2ec506566cb77d
  • curl_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:218a4591de7f002b2dc1e74c4ea368946ed1b5e4
  • libcurl3-gnutls_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:d4fb93e6e3423c18c7e8070831e6a1e064cd11cf
  • libcurl3-nss_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:f86540af07c6d6176dd399064989ba53ec07a893
  • libcurl4_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:8b456b0ca9a0c46790c8d4b1c65fcbf9302a27df
  • libcurl4-gnutls-dev_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:23f4e7eef45d5c3edd13ac3983a3759edf05b1e6
  • libcurl4-nss-dev_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:ec4f35a6e7a3e2a8819a9bb4f68cab2b1fde05b6
  • libcurl4-openssl-dev_7.68.0-1ubuntu2.25+tuxcare.els6_arm64.deb
    sha:f4ccec9d1ac590b04c477fea180e78d17b90b2e6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.