RHSA-2026:12916MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
May 2, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (6)

CVE-2026-6429 →CVE-2026-4873 →CVE-2026-5545 →CVE-2026-5773 →CVE-2026-6253 →CVE-2026-6276 →

📋 Description

CVE-2026-4873 — curl: curl: Information disclosure due to incorrect TLS connection reuse CVE-2026-5545 — curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse CVE-2026-5773 — curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse CVE-2026-6253 — curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6276 — curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers CVE-2026-6429 — curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

🎯 Affected products4

  • Red Hat Hardened Images
  • curl-main@aarch64 as a component of Red Hat Hardened Images
  • curl-main@src as a component of Red Hat Hardened Images
  • curl-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, avoid using clear-text IMAP, POP3, or SMTP transfers with curl. Ensure that all connections for these protocols are initiated with TLS from the outset to prevent the reuse of unencrypted connections. Workaround: To mitigate this issue, applications using libcurl can disable connection reuse. This can be achieved by setting one of the following libcurl options: CURLOPT_FRESH_CONNECT to force a new connection for each request, CURLOPT_MAXCONNECTS to limit the total number of open connections, or CURLMOPT_MAX_HOST_CONNECTIONS when using the curl_multi API to limit connections per host. Disabling connection reuse may impact application performance due to increased overhead for establishing new connections. Workaround: To mitigate this issue, avoid using SMB for transfers with libcurl. As SMB support is opt-in since curl 8.20.0 and SMBv1 is deprecated, ensuring SMB functionality is disabled or not utilized in applications leveraging libcurl will prevent exposure. If SMB is required, consider upgrading to curl 8.20.0 or later, which addresses this flaw by preventing SMB connection reuse. Workaround: To mitigate this issue, avoid configuring curl or libcurl to use proxies that require credentials. This prevents the scenario where credentials for a first proxy could be inadvertently passed to a second proxy during a redirect. Workaround: To mitigate this issue, avoid using custom `Host:` headers with libcurl, especially when reusing the same easy handle for multiple requests. This vulnerability primarily arises from specific debugging configurations. Workaround: To prevent the credential leak, avoid using the combination of .netrc for credentials, clear text HTTP URLs, and an HTTP proxy when making requests with libcurl. This operational control prevents the specific conditions that enable the vulnerability.

🔗 References (10)