{"schema":"vulnpedia.research/1","cve":"CVE-2026-8927","references":[{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","url":"https://curl.se/docs/CVE-2026-8927.json"},{"source":"nvd","sourceId":"CVE-2026-8927","modified":"2026-09-15T07:16:33.157","url":"https://curl.se/docs/CVE-2026-8927.json"},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://curl.se/docs/CVE-2026-8927.json"}]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["Patch","Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","url":"https://curl.se/docs/CVE-2026-8927.html"},{"source":"nvd","sourceId":"CVE-2026-8927","modified":"2026-09-15T07:16:33.157","url":"https://curl.se/docs/CVE-2026-8927.html"},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://curl.se/docs/CVE-2026-8927.html"}]},{"url":"https://hackerone.com/reports/3744543","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","origins":[{"source":"mitre","sourceId":"curl","modified":"2026-09-15T06:03:25.335Z","url":"https://hackerone.com/reports/3744543"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-07-06T17:01:06.213Z","url":"https://hackerone.com/reports/3744543"},{"source":"nvd","sourceId":"CVE-2026-8927","modified":"2026-09-15T07:16:33.157","url":"https://hackerone.com/reports/3744543"},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://hackerone.com/reports/3744543"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-8927"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-8927"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72506","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72506"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:55432","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:55432"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:69126","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:69126"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72399","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72399"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:29017","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:29017"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:34975"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:71603","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:71603"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72475","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72475"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72395","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72395"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72476","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72476"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72470","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72470"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:72394","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:72394"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:56869","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:56869"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:73516","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://access.redhat.com/errata/RHSA-2026:73516"}]},{"source":"euvd","sourceId":"EUVD-2026-41508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41508","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-41508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41508"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"AppStream-10.0.Z.E2S:curl-debuginfo-0:8.12.1-1.el10_0.10.aarch64","product":"curl-debuginfo-0:8.12.1-1.el10_0.10.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl-debuginfo@8.12.1-1.el10_0.10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"AppStream-10.2.Z:curl-debugsource-0:8.12.1-4.el10_2.4.s390x","product":"curl-debugsource-0:8.12.1-4.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:55432"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl-debugsource@8.12.1-4.el10_2.4?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:curl-minimal-debuginfo-0:7.76.1-40.el9_8.7.i686","product":"curl-minimal-debuginfo-0:7.76.1-40.el9_8.7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:69126"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl-minimal-debuginfo@7.76.1-40.el9_8.7?arch=i686","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"BaseOS-10.0.Z.E2S:curl-debuginfo-0:8.12.1-1.el10_0.10.s390x","product":"curl-debuginfo-0:8.12.1-1.el10_0.10.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:72506"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl-debuginfo@8.12.1-1.el10_0.10?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"BaseOS-10.2.Z:curl-0:8.12.1-4.el10_2.4.x86_64","product":"curl-0:8.12.1-4.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:55432"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl@8.12.1-4.el10_2.4?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"BaseOS-9.8.0.Z.MAIN.EUS:curl-0:7.76.1-40.el9_8.7.aarch64","product":"curl-0:7.76.1-40.el9_8.7.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:69126"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"BaseOS-9.8.0.Z.MAIN.EUS:libcurl-0:7.76.1-40.el9_8.7.ppc64le","product":"libcurl-0:7.76.1-40.el9_8.7.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:69126"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x","product":"registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.","url":"https://access.redhat.com/errata/RHSA-2026:72399"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:oci/cert-manager-operator-rhel9@sha256%3A0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca?arch=s390x&repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9&tag=1790272426","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat Hardened Images:curl-0:8.21.0-0.1.hum1@x86_64","product":"curl-0:8.21.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:29017"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/curl@8.21.0-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat Hardened Images:rust-std-static-aarch64-unknown-none-softfloat-0:1.96.1-1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"rust-std-static-aarch64-unknown-none-softfloat-0:1.96.1-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:rpm/redhat/rust-std-static-aarch64-unknown-none-softfloat@1.96.1-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:d20d237b12a31033a78d5a4dccf3ba61cfa43cdb564993c98997e6813d20cfd8_amd64","product":"registry.redhat.io/rhui5/rhua-rhel9@sha256:d20d237b12a31033a78d5a4dccf3ba61cfa43cdb564993c98997e6813d20cfd8_amd64 as a component of Red Hat Update Infrastructure 5","status":"fixed","remediations":[{"category":"vendor_fix","details":"The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.","url":"https://access.redhat.com/errata/RHSA-2026:71603"},{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."}],"purl":"pkg:oci/rhua-rhel9@sha256%3Ad20d237b12a31033a78d5a4dccf3ba61cfa43cdb564993c98997e6813d20cfd8?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1790242004","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"confidential_compute_attestation:build-of-trustee/trustee-rhel9","product":"build-of-trustee/trustee-rhel9 as a component of Confidential Compute Attestation","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/trustee-rhel9?repository_url=registry.redhat.io/build-of-trustee/trustee-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_10:snphost.src","product":"snphost.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/snphost?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_6:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_6:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_7:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_7:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_8:curl.src","product":"curl.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/curl?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_8:libcurl-devel","product":"libcurl-devel as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/libcurl-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_9:snphost.src","product":"snphost.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/snphost?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_jboss_core_services:libcurl.so","product":"libcurl.so as a component of Red Hat JBoss Core Services","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:generic/libcurl.so","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","product":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf_ppc64le","product":"registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Aa5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf?arch=ppc64le&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat OpenShift Dev Spaces 3.30:registry.redhat.io/devspaces/dashboard-rhel9@sha256:6b9d8089f76b0ba4008847692f2713a33949ef4774af43730d08b4b954dc317b_s390x","product":"registry.redhat.io/devspaces/dashboard-rhel9@sha256:6b9d8089f76b0ba4008847692f2713a33949ef4774af43730d08b4b954dc317b_s390x as a component of Red Hat OpenShift Dev Spaces 3.30","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/dashboard-rhel9@sha256%3A6b9d8089f76b0ba4008847692f2713a33949ef4774af43730d08b4b954dc317b?arch=s390x&repository_url=registry.redhat.io/devspaces/dashboard-rhel9&tag=1790617428","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat OpenShift Dev Spaces 3.30:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5edc00d72eb88b715d4240c76ced68cab413927727cfe5cb3e45554bf8530161_amd64","product":"registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5edc00d72eb88b715d4240c76ced68cab413927727cfe5cb3e45554bf8530161_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/jetbrains-ide-rhel9@sha256%3A5edc00d72eb88b715d4240c76ced68cab413927727cfe5cb3e45554bf8530161?arch=amd64&repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9&tag=1790616266","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat OpenShift Dev Spaces 3.30:registry.redhat.io/devspaces/openvsx-rhel9@sha256:7943be44109063a0d79a12eaef3520c048fcbc44f58fa47e692dec8ca4d88182_arm64","product":"registry.redhat.io/devspaces/openvsx-rhel9@sha256:7943be44109063a0d79a12eaef3520c048fcbc44f58fa47e692dec8ca4d88182_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/openvsx-rhel9@sha256%3A7943be44109063a0d79a12eaef3520c048fcbc44f58fa47e692dec8ca4d88182?arch=arm64&repository_url=registry.redhat.io/devspaces/openvsx-rhel9&tag=1790616590","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"Red Hat OpenShift Dev Spaces 3.30:registry.redhat.io/devspaces/traefik-rhel9@sha256:96673c650389efc3309c67ef909b92050190e47e821c7f4eb5d1a23cc6045161_arm64","product":"registry.redhat.io/devspaces/traefik-rhel9@sha256:96673c650389efc3309c67ef909b92050190e47e821c7f4eb5d1a23cc6045161_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/traefik-rhel9@sha256%3A96673c650389efc3309c67ef909b92050190e47e821c7f4eb5d1a23cc6045161?arch=arm64&repository_url=registry.redhat.io/devspaces/traefik-rhel9&tag=1790615456","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_10:rust","product":"rust as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/rust","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_10:rust-toolset-srpm-macros","product":"rust-toolset-srpm-macros as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/rust-toolset-srpm-macros","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_10:s390utils-mon_statd","product":"s390utils-mon_statd as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/s390utils-mon_statd","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_enterprise_linux_9:rust-debugger-common","product":"rust-debugger-common as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/rust-debugger-common","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]},{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json","productId":"red_hat_trusted_profile_analyzer:rhtpa/rhtpa-trustification-service-rhel9","product":"rhtpa/rhtpa-trustification-service-rhel9 as a component of Red Hat Trusted Profile Analyzer","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/rhtpa-trustification-service-rhel9?repository_url=registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-8927","modified":"2026-10-20T18:14:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8927.json"}]}],"vendorCoverage":{"total":395,"shown":32,"omitted":363,"source":"redhat"}}