The advisory covers two CVEs affecting Red Hat Hardened Images RPMs, including curl and libcurl packages. CVE-2026-7168 is a vulnerability in libcurl where reusing a handle for HTTP proxy transfers with Digest authentication causes the Proxy-Authorization header from the first proxy to be sent to a second, different proxy. This results in potential disclosure of sensitive authentication information to unintended proxies. The advisory lists updated RPMs (curl-8.20.0-2.hum1 and related packages) for aarch64 and x86_64 architectures. No explicit patch availability statement is given, but updated packages are provided. The advisory recommends avoiding reuse of handles when switching proxies as a mitigation. The CVSS score is not provided by Red Hat, but the impact is rated moderate to medium.

The vulnerability can lead to unintended disclosure of sensitive Proxy-Authorization headers to a different HTTP proxy when libcurl handles are reused across proxy hosts using Digest authentication. This could allow an attacker controlling the second proxy to gain unauthorized access or impersonate the user. The impact is limited to confidentiality loss without integrity or availability impact. No known exploits in the wild are reported.

Red Hat provides updated RPM packages for curl and libcurl as part of this advisory. Users should apply these updates to mitigate the vulnerability. Additionally, applications using libcurl should avoid reusing handles when switching between different HTTP proxies, especially after Digest authentication, to prevent disclosure of Proxy-Authorization headers. Patch status is not explicitly confirmed; users should refer to the Red Hat advisory and update instructions at https://images.redhat.com/ for the latest remediation guidance.