Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

The vulnerability identified as CVE-2026-1965 affects the curl utility and libcurl library by allowing authentication bypass caused by improper reuse of connections when using Negotiate authentication. This flaw could allow an attacker to bypass authentication mechanisms under certain conditions. The issue is present in various versions of curl shipped with Red Hat Enterprise Linux 9 and related Ubuntu packages. Red Hat has released a security advisory (RHSA-2026:55439) providing updated curl packages that fix this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication controls in curl when Negotiate authentication is used, potentially leading to unauthorized access or actions. The advisory rates the severity as important (high), indicating a significant security impact. There are no known exploits in the wild at this time.

A security update fixing this vulnerability is available and should be applied promptly. Red Hat provides updated curl packages as detailed in advisory RHSA-2026:55439. Users should follow the vendor's instructions to update their systems. No additional mitigation steps are indicated beyond applying the official patch.