RHSA-2026:82895 | Vulnetix

RHSA-2026:82895 PUBLISHED CVSS 4.800000190734863 MEDIUM

An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

Risk Scores

CVSS 3.1

4.800000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Products

Vendor	Product	Versions
Red Hat	libcurl-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-devel-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-devel-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	curl-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-devel-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	curl-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	curl-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	curl-0:8.23.0-0.1.hum1@src as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-minimal-0:8.23.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-minimal-0:8.23.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	8.23.0-0.1.hum1
Red Hat	libcurl-minimal-0:8.23.0-0.1.hum1@s390x as a component of Red Hat Hardened Images	8.23.0-0.1.hum1

Timeline

Oct 14, 2026 CVE Published
Oct 17, 2026 CVE Updated
Oct 17, 2026 Distribution Patch
Oct 17, 2026 Distribution Patch
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory
Oct 17, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:82895 advisory
https://images.redhat.com/ advisory
https://access.redhat.com/security/cve/CVE-2026-92392 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://access.redhat.com/security/cve/CVE-2026-92388 advisory
https://access.redhat.com/security/cve/CVE-2026-86414 advisory
https://access.redhat.com/security/cve/CVE-2025-14017 advisory
https://access.redhat.com/security/cve/CVE-2025-9086 advisory
https://access.redhat.com/security/cve/CVE-2025-14819 advisory
https://access.redhat.com/security/cve/CVE-2026-86410 advisory
https://access.redhat.com/security/cve/CVE-2026-92389 advisory
https://access.redhat.com/security/cve/CVE-2026-94265 advisory
https://access.redhat.com/security/cve/CVE-2026-107928 advisory
https://access.redhat.com/security/cve/CVE-2026-87866 advisory
https://access.redhat.com/security/cve/CVE-2026-94266 advisory
https://access.redhat.com/security/cve/CVE-2026-107929 advisory
https://access.redhat.com/security/cve/CVE-2026-92386 advisory
https://access.redhat.com/security/cve/CVE-2026-92391 advisory
https://access.redhat.com/security/cve/CVE-2026-92390 advisory
https://access.redhat.com/security/cve/CVE-2026-86413 advisory

…and 95 more

Open in Interactive Console →