A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

fedora FEDORA-2026-2f88b83676: curl-8.18.0-9.fc44

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57462 advisory.

    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57462 advisory.

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)


    Bug Fix(es) and Enhancement(s):

      * Regression of AlmaLinux-73788. The .9 revision appears to have broken the logic that forces NTLM to     use HTTP/1.1. (JIRA:AlmaLinux-171912)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57462 advisory.

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    Bug Fix(es) and Enhancement(s):

    * Regression of Rocky Linux-73788. The .9 revision appears to have broken the logic that forces NTLM to     use HTTP/1.1. (JIRA:Rocky Linux-171912)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57462 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    Bug Fix(es) and Enhancement(s):

    * Regression of RHEL-73788. The .9 revision appears to have broken the logic that forces NTLM to use     HTTP/1.1. (JIRA:RHEL-171912)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory.

    - fix proxy environment variable change detection (CVE-2026-8927)
    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix proxy connection reuse with wrong credentials (CVE-2026-3784)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)
    - fix schemeless URL handling with --proto-default (CVE-2026-12064)
    - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55439 advisory.

    - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
    - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
    - fix SSH host key mismatch on type difference (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55439 advisory.

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)
      * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)
      * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)
      * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55439 advisory.

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55439 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55450 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: libcurl: Improper certificate validation due to cached TLS settings reuse (CVE-2025-14819)

    * curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication     (CVE-2026-1965)

    * curl: curl: Unauthorized access due to improper HTTP proxy connection reuse (CVE-2026-3784)

    * curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect     (CVE-2026-3783)

    * curl: curl: Man-in-the-middle attack via SSH host key bypass (CVE-2026-9547)

    * curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)

    * curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP (CVE-2026-12064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3043-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2925-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2926-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21272-1 advisory.

    This update for curl fixes the following issues

    - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
    - CVE-2026-8458: wrong reuse for different services (bsc#1268407).
    - CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
    - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
    - CVE-2026-9079: stale proxy password leak (bsc#1268415).
    - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
    - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
    - CVE-2026-9547: SSH improper host validation (bsc#1268420).
    - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
    - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libcurl installed on the remote host is 7.30.0 prior to 8.21.0. It is, therefore, affected by a vulnerability:

  - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an     existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8487-1 advisory.

    Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based     connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use     this issue to cause curl to use an unintended TLS configuration. (CVE-2026-8286)

    Muhamad Arga Reksapati discovered that curl incorrectly reused connections for Negotiate-authenticated     requests when different services were involved. A remote attacker could possibly use this issue to access     resources authenticated for another service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)

    It was discovered that curl incorrectly handled cookie parsing in certain circumstances. A remote attacker     could possibly use this issue to set cookies that would be transmitted to unrelated third-party domains.
    This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu     24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8924)

    Joshua Rogers discovered that curl could double-free a GSASL context when handling SASL authentication. A     remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-8925)

    Joshua Rogers discovered that curl could select the wrong password from a .netrc file when a username was     specified in the URL without a password. A remote attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-8926)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. (CVE-2026-8927)

    Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li discovered that curl did not properly clear     proxy authentication credentials when instructed to do so. A remote attacker could possibly use this issue     to obtain sensitive credentials. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9079)

    Joshua Rogers discovered that curl contained a use-after-free when curl_easy_pause() was called within the     event-based socket callback. A remote attacker could possibly use this issue to cause a denial of service     or possibly execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-9080)

    Eunsoo Kim discovered that curl could send early data on a resumed TLS session before enforcing     certificate verification failure. A machine-in-the-middle attacker could possibly use this issue to obtain     sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9545)

    Joshua Rogers discovered that curl did not properly reject host key type mismatches when using the SSH key     callback for SCP and SFTP transfers. A machine-in-the-middle attacker could possibly use this issue to     impersonate a trusted server. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10,     and Ubuntu 26.04 LTS. (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is 7.30.0 prior to 8.21.0. It is, therefore, affected by an improper certificate validation vulnerability:

  - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an     existing live connection even though the TLS configuration mismatches so it should not.
    (CVE-2026-8286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an     existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
338775	Oracle Linux 8 : curl (ELSA-2026-57462)	Nessus	Oracle Linux Local Security Checks	Local	high
338764	AlmaLinux 8 : curl (ALSA-2026:57462)	Nessus	Alma Linux Local Security Checks	Local	high
338674	RockyLinux 8 : curl (RLSA-2026:57462)	Nessus	Rocky Linux Local Security Checks	Local	high
338332	RHEL 8 : curl (RHSA-2026:57462)	Nessus	Red Hat Local Security Checks	Local	high
338021	Oracle Linux 10 : curl (ELSA-2026-55450)	Nessus	Oracle Linux Local Security Checks	Local	high
338020	Oracle Linux 9 : curl (ELSA-2026-55439)	Nessus	Oracle Linux Local Security Checks	Local	high
337644	AlmaLinux 9 : curl (ALSA-2026:55439)	Nessus	Alma Linux Local Security Checks	Local	high
335981	RockyLinux 9 : curl (RLSA-2026:55439)	Nessus	Rocky Linux Local Security Checks	Local	high
335959	RHEL 9 : curl (RHSA-2026:55439)	Nessus	Red Hat Local Security Checks	Local	high
335952	RHEL 10 : curl (RHSA-2026:55450)	Nessus	Red Hat Local Security Checks	Local	high
334708	Photon OS 5.0: Curl PHSA-2026-5.0-90-0951	Nessus	PhotonOS Local Security Checks	Local	critical
333502	Photon OS 4.0: Curl PHSA-2026-4.0-1061	Nessus	PhotonOS Local Security Checks	Local	critical
327284	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3043-1)	Nessus	SuSE Local Security Checks	Local	critical
326957	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:2925-1)	Nessus	SuSE Local Security Checks	Local	critical
326933	SUSE SLES15 Security Update : curl (SUSE-SU-2026:2926-1)	Nessus	SuSE Local Security Checks	Local	critical
326418	openSUSE 16: curl / curl-fish-completion / curl-zsh-completion / libcurl-devel / etc (openSUSE-SU-2026:21272-1)	Nessus	SuSE Local Security Checks	Local	critical
326233	libcurl 7.30.0 < 8.21.0 Wrong STARTTLS Connection Reuse (CVE-2026-8286)	Nessus	Misc.	Local	high
324983	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : curl vulnerabilities (USN-8487-1)	Nessus	Ubuntu Local Security Checks	Local	critical
323003	Curl 7.30.0 < 8.21.0 Wrong STARTTLS Connection Reuse	Nessus	Misc.	Local	high
322458	Linux Distros Unpatched Vulnerability : CVE-2026-8286	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-8286

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

high

critical

high

high