[CLSA-2026:1793710694] alt-curlssl11: Fix of 27 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-03 12:58:41 UTC
Description:
- ALTPHP-2638: Update to 8.23.0. Security release: fixes CVE-2026-92392 (High, HTTP/2 upload use-after-free when the server sends RST_STREAM, affects 8.12.0 - 8.22.0) and the Low-severity CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-94265, CVE-2026-94266, CVE-2026-107929. CVE-2026-87866 (wolfSSL) and CVE-2026-107928 (GnuTLS) do not apply to this OpenSSL build. Full list: https://curl.se/docs/vuln-8.22.0.html - ALTPHP-2638: rebase the nscd hosts-cache patch onto 8.23.0 (context-only change: the resolver start function ends with CURL_THRDQ_TRACE() now). - ALTPHP-2638: skip upstream test 2095 (new in 8.23.0) in %check: it fails only in a full-suite run, with OpenSSL 1.1.1 and 3 alike, and passes alone. Upstream dropped SMB in 8.23.0; it was already left disabled here since 8.21.0-4, so the feature set is unchanged.
CVEs fixed:
Updated packages:
  • alt-curlssl11-8.23.0-1.el9.x86_64.rpm
    sha:5d3219cf710e02aac1d44573c32314069b85b38edd41ef1c0aa020c6bfe63c7b
  • alt-libcurlssl11-8.23.0-1.el9.x86_64.rpm
    sha:1f434081bc558888849c19f64a1d066bf48b2d888b0a73f5a52a4f9131f40740
  • alt-libcurlssl11-devel-8.23.0-1.el9.x86_64.rpm
    sha:8d4edbb819fb76d1e3d12ef48b02051d517c76a6d59f6290f2a520e6fd6b2c07
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.