[CLSA-2026:1793184342] Fix of 7 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-28 10:45:56 UTC
Description:
* SECURITY UPDATE: credentials leak to HTTP proxy on 401 during CONNECT - debian/patches/CVE-2026-86414.patch: credentials leak to HTTP proxy on 401 during CONNECT - CVE-2026-86414 * SECURITY UPDATE: TFTP direction confusion - debian/patches/CVE-2026-92389.patch: TFTP direction confusion - CVE-2026-92389 * SECURITY UPDATE: FTP wildcard write callback mixup - debian/patches/CVE-2026-92388.patch: FTP wildcard write callback mixup - CVE-2026-92388 * SECURITY UPDATE: IMAP APPEND command injection with CRLF conversion - debian/patches/CVE-2026-87864.patch: IMAP APPEND command injection with CRLF conversion - CVE-2026-87864 * SECURITY UPDATE: stack overflow by recursion in curl_mime_free - debian/patches/CVE-2026-92391.patch: stack overflow by recursion in curl_mime_free - CVE-2026-92391 * SECURITY UPDATE: password leak in CURLINFO_EFFECTIVE_URL - debian/patches/CVE-2026-94266.patch: password leak in CURLINFO_EFFECTIVE_URL - CVE-2026-94266 * SECURITY UPDATE: libssh2 hashed known_hosts entry matched without host - debian/patches/CVE-2026-87865.patch: libssh2 hashed known_hosts entry matched without host - CVE-2026-87865
CVEs fixed:
Updated packages:
  • curl_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:9b09ec9249c84f8abeb82a262c3445a80bfbe070
  • libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:2f7773ee16997326ebb2e3fbdbbc9e36e4b35f19
  • libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:8a9a54dcd010fc4a2168b8704ba95db38f15fdf5
  • libcurl4_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:0b0689a49030773a3d3b2522a51791cdc36c6b05
  • libcurl4-doc_7.74.0-1.3+deb11u16+tuxcare.els4_all.deb
    sha:63aa4a27711101bcc5b044fdc28c169d7440c05c
  • libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:07b8179eb716d889cd21481bf95558df3678e82c
  • libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:51fbcdc74f3e1c96b77c0accbd8d8e1819272012
  • libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els4_amd64.deb
    sha:74d9c281a8052e240a267d2b6b85c3746bbcbb88
  • curl_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:c5618b31bb42a9f6d67a6e86cac536ad510e5fa9
  • libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:5dc58a55ff93136ad5403d7e8f5d10ae32bec19b
  • libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:ab71d7a6f73ca281aadd69714001bcbd7f222e88
  • libcurl4_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:20ac466ed8a28ec5339f3e65778d45386c5e4d97
  • libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:97748624aa8ca514f8b9abe1110c9a771849f619
  • libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:0b365c6ccb53a6cb4b36827559e89f88ed8b295a
  • libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els4_arm64.deb
    sha:3d7a1014524c8f3ba8cfe35d2cbd1ebbbd2dd395
  • curl_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:d7f5a8f70f1b3fe1b8dc0b0830774783f76f129d
  • libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:a24e6abc5a8f004e078c6b0d19c7ce1c7fc47125
  • libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:a0060f28c965c77068fd86c131a435b64e8980a3
  • libcurl4_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:34a51ce6e0b33d0906b8cdc6cb09ab842e02e14a
  • libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:e819f0d99d2f127e4475c87d5d61cc68a8a9da02
  • libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:1a8ed458743fbc96dd121f8509cb76e07a0a2d04
  • libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els4_armel.deb
    sha:7ce7d9088c0e46256a4ba2037499606e0129f462
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.