{"cves":["CVE-2026-1965","CVE-2026-3783","CVE-2026-8286","CVE-2026-9547"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[7.76.1-40.el9_8.5]\n- fix missing %patch macros for Patch46 and Patch47\n\n[7.76.1-40.el9_8.4]\n- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)\n- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)\n- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)\n\n[7.76.1-40.3]\n- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)\n\n[7.76.1-40.1]\n- fix SSH host key mismatch on type difference (CVE-2026-9547)\n- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)","id":"ELSA-2026-55439","ovalId":"oval:com.oracle.elsa:def:202655439","source":"oracle_linux","title":"ELSA-2026-55439:  curl security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-55439.html"}