Detections
Analytics
Alpine: libcurl, multiple curl packages: security update to 8.23.0-r0
high Tenable Cloud Security Plugin ID 477458
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason
`HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
(CVE-2026-92392)
- When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send
buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of
bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked
send. (CVE-2026-107928)
- When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the
documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so
a later transfer asking for a different source can silently reuse an existing connection and go out from
the earlier transfer's source address (CVE-2026-107929)
- Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations
and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-
SHA256` header to whatever URL isset next, leaking state information. (CVE-2026-86409)
- A flaw in the curl command line tool's logic makes it only set SSH host verification options when
interacting directly using SFTP or SCP, and not as a result of following a redirect. (CVE-2026-86410)
Solution
Update the curl library and its related packages to version 8.23.0-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-107928
https://security.alpinelinux.org/vuln/CVE-2026-107929
https://security.alpinelinux.org/vuln/CVE-2026-86409
https://security.alpinelinux.org/vuln/CVE-2026-86410
https://security.alpinelinux.org/vuln/CVE-2026-86411
https://security.alpinelinux.org/vuln/CVE-2026-86412
https://security.alpinelinux.org/vuln/CVE-2026-86413
https://security.alpinelinux.org/vuln/CVE-2026-86414
https://security.alpinelinux.org/vuln/CVE-2026-86415
https://security.alpinelinux.org/vuln/CVE-2026-87861
https://security.alpinelinux.org/vuln/CVE-2026-87862
https://security.alpinelinux.org/vuln/CVE-2026-87863
https://security.alpinelinux.org/vuln/CVE-2026-87864
https://security.alpinelinux.org/vuln/CVE-2026-87865
https://security.alpinelinux.org/vuln/CVE-2026-87866
https://security.alpinelinux.org/vuln/CVE-2026-92386
https://security.alpinelinux.org/vuln/CVE-2026-92387
https://security.alpinelinux.org/vuln/CVE-2026-92388
https://security.alpinelinux.org/vuln/CVE-2026-92389
https://security.alpinelinux.org/vuln/CVE-2026-92390
https://security.alpinelinux.org/vuln/CVE-2026-92391
https://security.alpinelinux.org/vuln/CVE-2026-92392
Plugin Details
Severity: High
ID: 477458
Version: Revision 1.1
Type: Local
Published: 10/25/2026
Updated: 10/25/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: High
Score: 7.9
Percentile: 99.33
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-92392
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 10/14/2026
Reference Information
CVE: CVE-2026-107928, CVE-2026-107929, CVE-2026-86409, CVE-2026-86410, CVE-2026-86411, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87864, CVE-2026-87865, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-92392, CVE-2026-94265, CVE-2026-94266
IAVA: 2026-A-1143