This Red Hat security advisory addresses seven distinct vulnerabilities in the curl packages, including libcurl and the curl utility. The issues fixed are: improper certificate validation due to cached TLS settings reuse (CVE-2025-14819), authentication bypass from incorrect connection reuse with Negotiate authentication (CVE-2026-1965), unauthorized access from improper HTTP proxy connection reuse (CVE-2026-3784), information disclosure via OAuth2 bearer token leakage during HTTP(S) redirects (CVE-2026-3783), man-in-the-middle attack via SSH host key bypass (CVE-2026-9547), insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286), and SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064). These vulnerabilities affect Red Hat Enterprise Linux 10 and its extended update support versions. The advisory references fixes available in updated packages and provides links for applying the updates.

The vulnerabilities collectively could allow attackers to bypass authentication, gain unauthorized access, disclose sensitive OAuth2 tokens, perform man-in-the-middle attacks, and bypass SSH host verification. These issues undermine the security guarantees of TLS, SSH, and HTTP proxy connections used by curl, potentially exposing systems to credential theft, session hijacking, and unauthorized data access. The advisory rates the impact as Important (high severity).

Red Hat has released updated curl packages that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 10 and its variants should apply the provided updates promptly. Detailed instructions and updated packages are available at the Red Hat advisory page: https://access.redhat.com/articles/11258. No additional mitigations beyond applying the official patches are indicated.