A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-minimalUpgrade curl-minimalUpgrade curlUpgrade libcurl-develUpgrade libcurl | Oct 11, 2026 | Aug 17, 2026 |
| Alpine Linux | — | Upgrade curl | Jul 6, 2026 | Jul 3, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade curl-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade curl-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurlUpgrade libcurl-minimal | Sep 30, 2026 | Jul 3, 2026 |
| Debian | — | Upgrade curl | Oct 20, 2026 | Jul 3, 2026 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory11 | Jul 28, 2026 | Jul 28, 2026 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade curlUpgrade libcurlUpgrade libcurl-minimal | Oct 22, 2026 | Jul 3, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 3, 2026 | Jul 3, 2026 |
| Redhat_linux | — | Upgrade libcurlUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade curl-minimal-debuginfoNo solution existsUpgrade libcurl-minimalUpgrade curl-minimalUpgrade libcurl-minimal-debuginfo | Jul 17, 2026 | Jul 3, 2026 |
| Rocky_linux | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade curl-debuginfoUpgrade curlUpgrade curl-debugsourceUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-minimal | Aug 20, 2026 | Aug 17, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.7Upgrade Splunk Enterprise to version 10.0.10Upgrade Splunk Enterprise to version 9.4.15Upgrade Splunk Enterprise to version 10.4.3 | Oct 20, 2026 | Jul 3, 2026 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl4 (Ubuntu Pro)Upgrade curlUpgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl4t64Upgrade libcurl4-nss-devUpgrade libcurl4-openssl-devUpgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade libcurl4-gnutls-dev (Ubuntu Pro)Upgrade libcurl4-gnutls-devUpgrade libcurl3t64-gnutlsUpgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl3-nss (Ubuntu Pro) | Jul 1, 2026 | Jun 30, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 10, 2026 | Jul 3, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub