[CLSA-2026:1793710515] alt-curlssl11: Fix of 27 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-03 12:55:43 UTC
Description:
- ALTPHP-2638: Update to 8.23.0. Security release: fixes CVE-2026-92392 (High, HTTP/2 upload use-after-free when the server sends RST_STREAM, affects 8.12.0 - 8.22.0) and the Low-severity CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-94265, CVE-2026-94266, CVE-2026-107929. CVE-2026-87866 (wolfSSL) and CVE-2026-107928 (GnuTLS) do not apply to this OpenSSL build. Full list: https://curl.se/docs/vuln-8.22.0.html - ALTPHP-2638: rebase the nscd hosts-cache patch onto 8.23.0 (context-only change: the resolver start function ends with CURL_THRDQ_TRACE() now). - ALTPHP-2638: skip upstream test 2095 (new in 8.23.0) in %check: it fails only in a full-suite run, with OpenSSL 1.1.1 and 3 alike, and passes alone. Upstream dropped SMB in 8.23.0; it was already left disabled here since 8.21.0-4, so the feature set is unchanged.
CVEs fixed:
Updated packages:
  • alt-curlssl11-8.23.0-1.el7.x86_64.rpm
    sha:ae5a1dd315e3e3494d10a062388996b2ab7812aef1418be580a275e7a7f12415
  • alt-libcurlssl11-8.23.0-1.el7.x86_64.rpm
    sha:fce288030008a1abc253d991ef440818f3439ca5c48216e9c54f385710558af1
  • alt-libcurlssl11-devel-8.23.0-1.el7.x86_64.rpm
    sha:a633635d7a0fb93f412bd01be59b1caf9ed7b4ab4bd759287d1f4afb8cb4c9cf
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.