[CLSA-2026:1793710919] alt-curlssl11: Fix of 27 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-03 13:02:21 UTC
Description:
- ALTPHP-2638: Update to 8.23.0. Security release: fixes CVE-2026-92392 (High, HTTP/2 upload use-after-free when the server sends RST_STREAM, affects 8.12.0 - 8.22.0) and the Low-severity CVE-2026-86410, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87865, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-94265, CVE-2026-94266, CVE-2026-107929. CVE-2026-87866 (wolfSSL) and CVE-2026-107928 (GnuTLS) do not apply to this OpenSSL build. Full list: https://curl.se/docs/vuln-8.22.0.html - ALTPHP-2638: rebase the nscd hosts-cache patch onto 8.23.0 (context-only change: the resolver start function ends with CURL_THRDQ_TRACE() now). - ALTPHP-2638: skip upstream test 2095 (new in 8.23.0) in %check: it fails only in a full-suite run, with OpenSSL 1.1.1 and 3 alike, and passes alone. Upstream dropped SMB in 8.23.0; it was already left disabled here since 8.21.0-4, so the feature set is unchanged.
CVEs fixed:
Updated packages:
  • alt-curlssl11-8.23.0-1.el8.x86_64.rpm
    sha:047d376c21e48f889260dd7ba5e5bd6bba23c0855caf3779a7bb319045c1b57f
  • alt-libcurlssl11-8.23.0-1.el8.x86_64.rpm
    sha:2b00f092e911414489468bc2312505641e3e4f15aec5b4e491bb9704e8c6ba1d
  • alt-libcurlssl11-devel-8.23.0-1.el8.x86_64.rpm
    sha:6c95d38673699b6285d3ef4d3a0b757519990ee29ffc8c83a7452977677e82a8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.