{"schema":"vulnpedia.research/1","cve":"CVE-2026-11856","references":[{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","url":"https://curl.se/docs/CVE-2026-11856.json"},{"source":"nvd","sourceId":"CVE-2026-11856","modified":"2026-09-15T07:16:25.870","url":"https://curl.se/docs/CVE-2026-11856.json"},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://curl.se/docs/CVE-2026-11856.json"}]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["Patch","Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","url":"https://curl.se/docs/CVE-2026-11856.html"},{"source":"nvd","sourceId":"CVE-2026-11856","modified":"2026-09-15T07:16:25.870","url":"https://curl.se/docs/CVE-2026-11856.html"},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://curl.se/docs/CVE-2026-11856.html"}]},{"url":"https://hackerone.com/reports/3793260","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:02:42.790Z","url":"https://hackerone.com/reports/3793260"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-07-06T18:23:52.111Z","url":"https://hackerone.com/reports/3793260"},{"source":"nvd","sourceId":"CVE-2026-11856","modified":"2026-09-15T07:16:25.870","url":"https://hackerone.com/reports/3793260"},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://hackerone.com/reports/3793260"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-11856"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-11856"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72506"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:69125","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:69125"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:80511","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:80511"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:29017","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:29017"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:34975"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:82939","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:82939"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:79357","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:79357"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:56869","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:56869"}]},{"source":"euvd","sourceId":"EUVD-2026-41501","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41501","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-41501","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41501"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"AppStream-10.0.Z.E2S:curl-debuginfo-0:8.12.1-1.el10_0.10.aarch64","product":"curl-debuginfo-0:8.12.1-1.el10_0.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl-debuginfo@8.12.1-1.el10_0.10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"AppStream-10.0.Z.E2S:libcurl-minimal-debuginfo-0:8.12.1-1.el10_0.10.aarch64","product":"libcurl-minimal-debuginfo-0:8.12.1-1.el10_0.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-1.el10_0.10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"AppStream-10.2.Z:libcurl-devel-0:8.12.1-4.el10_2.6.aarch64","product":"libcurl-devel-0:8.12.1-4.el10_2.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:69125"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl-devel@8.12.1-4.el10_2.6?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:curl-debugsource-0:7.76.1-40.el9_8.8.s390x","product":"curl-debugsource-0:7.76.1-40.el9_8.8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80511"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl-debugsource@7.76.1-40.el9_8.8?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:libcurl-minimal-debuginfo-0:7.76.1-40.el9_8.8.aarch64","product":"libcurl-minimal-debuginfo-0:7.76.1-40.el9_8.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80511"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl-minimal-debuginfo@7.76.1-40.el9_8.8?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-10.0.Z.E2S:curl-debugsource-0:8.12.1-1.el10_0.10.s390x","product":"curl-debugsource-0:8.12.1-1.el10_0.10.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl-debugsource@8.12.1-1.el10_0.10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-10.0.Z.E2S:libcurl-minimal-debuginfo-0:8.12.1-1.el10_0.10.s390x","product":"libcurl-minimal-debuginfo-0:8.12.1-1.el10_0.10.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl-minimal-debuginfo@8.12.1-1.el10_0.10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-10.2.Z:libcurl-0:8.12.1-4.el10_2.6.ppc64le","product":"libcurl-0:8.12.1-4.el10_2.6.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:69125"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl@8.12.1-4.el10_2.6?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-9.8.0.Z.MAIN.EUS:curl-0:7.76.1-40.el9_8.8.ppc64le","product":"curl-0:7.76.1-40.el9_8.8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80511"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl@7.76.1-40.el9_8.8?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-9.8.0.Z.MAIN.EUS:curl-minimal-0:7.76.1-40.el9_8.8.s390x","product":"curl-minimal-0:7.76.1-40.el9_8.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80511"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl-minimal@7.76.1-40.el9_8.8?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"BaseOS-9.8.0.Z.MAIN.EUS:libcurl-debuginfo-0:7.76.1-40.el9_8.8.x86_64","product":"libcurl-debuginfo-0:7.76.1-40.el9_8.8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:80511"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/libcurl-debuginfo@7.76.1-40.el9_8.8?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"Red Hat Hardened Images:curl-0:8.21.0-0.1.hum1@src","product":"curl-0:8.21.0-0.1.hum1@src as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:29017"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/curl@8.21.0-0.1.hum1?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"Red Hat Hardened Images:rust-doc-0:1.96.1-1.hum1@x86_64","product":"rust-doc-0:1.96.1-1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/rust-doc@1.96.1-1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"Red Hat Hardened Images:rust-std-static-wasm32-unknown-unknown-0:1.96.1-1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"rust-std-static-wasm32-unknown-unknown-0:1.96.1-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:rpm/redhat/rust-std-static-wasm32-unknown-unknown@1.96.1-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:fa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827_amd64","product":"registry.redhat.io/rhui5/rhua-rhel9@sha256:fa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827_amd64 as a component of Red Hat Update Infrastructure 5","status":"fixed","remediations":[{"category":"vendor_fix","details":"The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.","url":"https://access.redhat.com/errata/RHSA-2026:82939"},{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"}],"purl":"pkg:oci/rhua-rhel9@sha256%3Afa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1791978693","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_6:curl","product":"curl as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/curl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_6:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_6:libcurl","product":"libcurl as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/libcurl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_6:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_7:curl","product":"curl as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/curl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_7:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_7:libcurl","product":"libcurl as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/libcurl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_7:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_8:curl","product":"curl as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/curl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_8:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_8:libcurl","product":"libcurl as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/libcurl","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_8:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_enterprise_linux_8:libcurl-minimal","product":"libcurl-minimal as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/libcurl-minimal","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","product":"openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nCorrect usage of the library: Create a fresh handle for a different origin, or explicitly clear authentication-related state before reuse:\n```c\n// req.A\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n\n\n// req.B\ncurl = curl_easy_init();\n...\ncurl_easy_cleanup(curl);\n```\n\nFixed in libcurl 8.21.0; affected range: 7.10.6 – 8.20.0"},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_openshift_dev_spaces:devspaces/code-rhel9","product":"devspaces/code-rhel9 as a component of Red Hat OpenShift Dev Spaces","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/code-rhel9?repository_url=registry.redhat.io/devspaces/code-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]},{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json","productId":"red_hat_trusted_profile_analyzer:rhtpa/rhtpa-trustification-service-rhel9","product":"rhtpa/rhtpa-trustification-service-rhel9 as a component of Red Hat Trusted Profile Analyzer","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/rhtpa-trustification-service-rhel9?repository_url=registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-11856","modified":"2026-10-14T19:15:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11856.json"}]}],"vendorCoverage":{"total":244,"shown":32,"omitted":212,"source":"redhat"}}