{
  "cves": [
    "CVE-2026-1965",
    "CVE-2026-3783",
    "CVE-2026-8286",
    "CVE-2026-9547"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[7.76.1-40.el9_8.5]\n- fix missing %patch macros for Patch46 and Patch47\n\n[7.76.1-40.el9_8.4]\n- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)\n- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)\n- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)\n\n[7.76.1-40.3]\n- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)\n\n[7.76.1-40.1]\n- fix SSH host key mismatch on type difference (CVE-2026-9547)\n- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)",
  "id": "ELSA-2026-55439",
  "ovalId": "oval:com.oracle.elsa:def:202655439",
  "source": "oracle_linux",
  "title": "ELSA-2026-55439:  curl security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-55439.html"
}