[CLSA-2026:1793711094] alt-curlssl11: Fix of 26 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-03 13:05:16 UTC
Description:
- ALTPHP-2638: Update to 8.23.0. Security release: fixes CVE-2026-92392 (High, HTTP/2 upload use-after-free when the server sends RST_STREAM, affects 8.12.0 - 8.22.0) and the Low-severity CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-94265, CVE-2026-94266, CVE-2026-107929. CVE-2026-87866 (wolfSSL) and CVE-2026-107928 (GnuTLS) do not apply to this OpenSSL build. Full list: https://curl.se/docs/vuln-8.22.0.html - ALTPHP-2638: rebase the nscd hosts-cache patch onto 8.23.0 (context-only change: the resolver start function ends with CURL_THRDQ_TRACE() now). - ALTPHP-2638: skip upstream test 2095 (new in 8.23.0) in %check: it fails only in a full-suite run, with OpenSSL 1.1.1 and 3 alike, and passes alone. Upstream dropped SMB in 8.23.0; it was already left disabled here since 8.21.0-4, so the feature set is unchanged.
CVEs fixed:
Updated packages:
  • alt-curlssl11-8.23.0-1.el10.x86_64.rpm
    sha:23e33a8f85949ea8370e1b205d72982c93cb5c2f5dc596518fe9112f4f89c631
  • alt-libcurlssl11-8.23.0-1.el10.x86_64.rpm
    sha:5910dbce35080d5f43f8c74d9cf1e4fdcd299bb299ec77a02aa29aac1423ba0a
  • alt-libcurlssl11-devel-8.23.0-1.el10.x86_64.rpm
    sha:cbbc905fbb25799a494c107184519b754e18be28547d69c3813103a8f3d3b089
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.