RHSA-2026:63161MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 3, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (8)

CVE-2026-80229 →CVE-2026-80230 →CVE-2026-80231 →CVE-2026-80255 →CVE-2026-82209 →CVE-2026-13608 →CVE-2026-18924 →CVE-2026-19931 →

📋 Description

CVE-2026-13608 — curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack CVE-2026-18924 — curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections CVE-2026-19931 — curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication CVE-2026-80229 — curl: libcurl: Memory corruption vulnerability via OpenSSL 3 provider use-after-free CVE-2026-80230 — curl: curl: Public key pinning bypass allows unauthenticated connections CVE-2026-80231 — curl: curl: Incorrect HTTPS connection reuse with Native CA Store CVE-2026-80255 — curl: curl: Information disclosure due to secure cookie attribute bypass CVE-2026-82209 — curl: libcurl: Information disclosure via improper Public Suffix List boundary check

🎯 Affected products10

  • Red Hat Hardened Images
  • curl-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • curl-0:8.22.0-0.1.hum1@src as a component of Red Hat Hardened Images
  • curl-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • libcurl-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libcurl-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • libcurl-devel-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libcurl-devel-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • libcurl-minimal-0:8.22.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libcurl-minimal-0:8.22.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate enforce strict mutual authentication and cryptographic verification of both endpoints before transmitting sensitive data. Implement robust TLS/SSL configurations with explicit certificate pinning or strict CA validation to prevent Man-in-the-Middle (MITM) attackers from intercepting, prematurely concluding, or manipulating the handshake. Workaround: Disable HTTP/2 Server Push (CURLMOPT_PUSHFUNCTION) and shared connection handles (CURL_LOCK_DATA_CONNECT) in libcurl clients to eliminate the vulnerable code path. If these features cannot be disabled, enforce host-based firewalls to restrict affected applications' outbound HTTPS traffic solely to trusted endpoints, neutralizing the risk of exploitation by malicious HTTP/2 servers. Workaround: To mitigate this prevent connection reuse (CURLOPT_FORBID_REUSE) for transfers using Negotiate authentication with empty credentials and strictly isolate libcurl connection pools across different security principals. For defense-in-depth, enforce network boundaries to limit outbound HTTP access, mitigating the impact of any potential cross-session data exposure while pending upstream patches. Workaround: To mitigate developers should ensure pointers are set to NULL immediately after the memory they point to is freed. In production environments, administrators can mitigate this specific flaw by enabling the CURLOPT_FORBID_REUSE option for transfers using OpenSSL providers to prevent connection pooling from retaining dangling pointers. Workaround: To mitigate this issue, ensure that SSL/TLS peer verification is enabled by setting `CURLOPT_SSL_VERIFYPEER` and `CURLOPT_SSL_VERIFYHOST` to `1` (or not explicitly disabling them). This ensures that libcurl properly enforces public key pinning and validates server certificates. Workaround: To mitigate this enforce strict HTTPS-only communication (e.g., via HSTS and redirecting all HTTP traffic to HTTPS) across your web infrastructure to ensure curl cannot transmit data over plaintext HTTP. Alternatively, configure reverse proxies or load balancers to sanitize incoming HTTP headers by stripping or replacing horizontal tabs (HTAB) in Set-Cookie headers before they reach the client. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)