curl: curl: local interface connection reuse mixup (CVE-2026-107929)

Overview

A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface.

Vendor advisories

• RHSA-2026:82895 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-14 · advisory
• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat JBoss Core Services, Red Hat Satellite 6 · no fix planned: Red Hat JBoss Core Services, Red Hat Satellite 6, Red Hat Enterprise Linux 10 · updated 2026-10-23 · vex

curl: curl: local interface connection reuse mixup — rated Low by Red Hat. Released 2026-10-14, updated 2026-10-23.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat JBoss Core Services
• Red Hat Satellite 6

Fixed:

• Red Hat Hardened Images

No fix planned:

• Red Hat JBoss Core Services
• Red Hat Satellite 6
• Red Hat Enterprise Linux 10

Not affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Hardened Images
• Red Hat Satellite 6

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:82895