[ol10_baseos_latest] libcurl-8.12.1-4.el10_2.6.aarch64

Name:	libcurl
Version:	8.12.1
Release:	4.el10_2.6
Architecture:	aarch64
Group:	Unspecified
Size:	878718
License:	curl
RPM:	libcurl-8.12.1-4.el10_2.6.aarch64.rpm
Source RPM:	curl-8.12.1-4.el10_2.6.src.rpm
Build Date:	Wed Sep 23 2026
Build Host:	build-ol10-aarch64.oracle.com
Vendor:	Oracle America
URL:	https://curl.se/
Summary:	A library for getting files from web servers
Description:	libcurl is a free and easy-to-use client-side URL transfer library, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer resume, http proxy tunneling and more.

Changelog (Show File list) (Show related packages)

Thu Sep 03 2026 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4.6

- fix cookie injection via trailing dot super cookies (CVE-2026-8924)
- fix digest auth state leak on origin or credential change (CVE-2026-11856)
- fix netrc password lookup for non-matching login (CVE-2026-8926)

Mon Aug 31 2026 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4.5

- fix proxy auth not cleared properly on NULL (CVE-2026-9079)
- fix incomplete mTLS config in connection reuse and session cache
  (CVE-2026-8932)
- fix SASL service name connection reuse bypass (CVE-2026-8458)

Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 8.12.1-4.4
```
- fix proxy environment variable change detection (CVE-2026-8927)
```

Wed Jul 22 2026 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4.el10_2.3

- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- fix proxy connection reuse with wrong credentials (CVE-2026-3784)

Mon Jul 13 2026 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4.2

- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix schemeless URL handling with --proto-default (CVE-2026-12064)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Mon Apr 20 2026 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4.1

- openssl: fix CA cache reuse with CURLSSLOPT_NO_PARTIALCHAIN (CVE-2025-14819)

Mon Nov 17 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-4

- openssl: respect system crypto policy for TLS max version (RHEL-128916)

Mon Oct 20 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-3

- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
  Resolves: RHEL-121672

Tue Apr 15 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-2

- revert using tls-ca-bundle.pem instead of ca-bundle.crt (RHEL-56966)
  (temporary revert to workaround another issue RHEL-85608)

Wed Mar 19 2025 Jacek Migacz <jmigacz@redhat.com> - 8.12.1-1
```
- new upstream release (RHEL-84132)
```