{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-3784-els_os-cloudlinux7els.json" } ], "tracking": { "current_release_date": "2026-06-12T22:09:47Z", "generator": { "date": "2026-06-12T22:09:47Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-3784-ELS_OS-CLOUDLINUX7ELS", "initial_release_date": "2026-03-11T11:16:00Z", "revision_history": [ { "date": "2026-03-11T11:16:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-06-12T22:09:47Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-3784" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" }, { "branches": [ { "category": "product_version", "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl@7.29.0-59.0.3.el7_9.2?arch=x86_64" } } }, { "category": "product_version", "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64", "product": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl-devel@7.29.0-59.0.3.el7_9.2?arch=x86_64" } } }, { "category": "product_version", "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product": { "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_id": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/curl@7.29.0-59.0.3.el7_9.2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "product": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl@7.29.0-59.0.3.el7_9.2?arch=i686" } } }, { "category": "product_version", "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "product": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl-devel@7.29.0-59.0.3.el7_9.2?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl-devel@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product": { "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_id": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/curl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product_id": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product_id": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libcurl-devel@7.29.0-59.0.3.el7_9.2.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64" }, "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64" }, "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686" }, "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686" }, "product_reference": "libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686" }, "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686" }, "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64" }, "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64" }, "product_reference": "libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64" }, "product_reference": "curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64" }, "product_reference": "curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3784", "cwe": { "id": "CWE-305", "name": "Authentication Bypass by Primary Weakness" }, "notes": [ { "category": "description", "text": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-3784" } ], "release_date": "2026-03-11T11:16:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-06-12T13:06:07.838801Z", "details": "This vulnerability allows curl to reuse an HTTP proxy CONNECT tunnel even when a subsequent request uses different proxy credentials. While the official affected range is curl 7.7-8.18.0, curl 7.29.0 as shipped in EL7 is structurally not affected: the vulnerable code path stems from a later refactoring (post-7.29) that moved proxy credential comparison out of the connection reuse logic. In 7.29.0, proxy credentials are verified inline during connection matching, so the mismatch condition cannot occur. Additionally, exploitation requires a multi-tenant architecture using shared connection caches (CURLSH with CURL_LOCK_DATA_CONNECT) with alternating proxy credentials, an extremely uncommon configuration on EL7 systems. Backporting the fix would require adapting extensively restructured connection reuse code with high regression risk and negligible practical benefit.\n\n*Remediation:* If your application uses libcurl shared connection caches with different proxy credentials per handle, use separate CURLSH instances for each credential set, or avoid reusing proxy connections across credential boundaries.", "product_ids": [ "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:curl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-0:7.29.0-59.0.3.el7_9.2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.i686", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.tuxcare.els2.x86_64", "CloudLinux-7:libcurl-devel-0:7.29.0-59.0.3.el7_9.2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }