RHSA-2026:41240MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
July 17, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (3)

CVE-2026-9545 →CVE-2026-10536 →CVE-2026-58055 →

📋 Description

CVE-2026-9545 — libcurl: libcurl: Information disclosure via cached SSL session and early data CVE-2026-10536 — libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service CVE-2026-58055 — nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

🎯 Affected products4

  • Red Hat Hardened Images
  • curl-main@aarch64 as a component of Red Hat Hardened Images
  • curl-main@src as a component of Red Hat Hardened Images
  • curl-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability. Workaround: Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users.

🔗 References (7)