RHSA-2026:6893MediumCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 7, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (13)

CVE-2025-9086 →CVE-2025-10148 →CVE-2025-10966 →CVE-2025-14017 →CVE-2025-15224 →CVE-2026-1965 →CVE-2026-3783 →CVE-2026-3805 →CVE-2025-13034 →CVE-2025-14524 →CVE-2025-14819 →CVE-2025-15079 →CVE-2026-3784 →

📋 Description

CVE-2025-9086 — curl: libcurl: Curl out of bounds read for cookie path CVE-2025-10148 — curl: predictable WebSocket mask CVE-2025-10966 — curl: Curl missing SFTP host verification with wolfSSH backend CVE-2025-13034 — curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation CVE-2025-14017 — curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers CVE-2025-14524 — curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token CVE-2025-14819 — curl: libcurl: Improper certificate validation due to cached TLS settings reuse CVE-2025-15079 — curl: Host verification bypass during SSH transfers CVE-2025-15224 — curl: libssh key passphrase bypass without agent set CVE-2026-1965 — curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-3783 — curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect CVE-2026-3784 — curl: curl: Unauthorized access due to improper HTTP proxy connection reuse CVE-2026-3805 — curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling

🎯 Affected products4

  • Red Hat Hardened Images
  • curl-main@aarch64 as a component of Red Hat Hardened Images
  • curl-main@src as a component of Red Hat Hardened Images
  • curl-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, ensure that standard certificate verification is not explicitly disabled when utilizing `CURLOPT_PINNEDPUBLICKEY` or `--pinnedpubkey` with curl. This practice prevents the bypass of the pinned public key check, particularly in configurations involving QUIC and `ngtcp2` built with GnuTLS. Always verify server certificates through standard means to maintain secure connections. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that the system-wide `libssh` global knownhosts file (`/etc/ssh/ssh_known_hosts`) does not contain entries for untrusted hosts. Alternatively, avoid using `libcurl` for SCP or SFTP transfers in environments where strict enforcement of a user-specified knownhosts file is critical and the system-wide knownhosts file cannot be fully controlled. Services relying on `libssh` for host key verification may need to be restarted to apply the changes. Workaround: To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations. Workaround: To mitigate this issue, avoid using curl for Server Message Block (SMB) transfers. This can be achieved by ensuring that applications utilizing curl do not initiate SMB requests. If SMB transfers are essential, consider isolating the affected systems or restricting network access to SMB services. A service restart or reload may be required for changes to take effect.

🔗 References (17)