ALAS2027-2026-192

References: CVE-2026-80230  CVE-2026-19931  CVE-2026-80229  CVE-2026-82209  CVE-2026-18924  CVE-2026-80255  CVE-2026-13608 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-82209:
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).

CVE-2026-80255:
A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

CVE-2026-80230:
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

CVE-2026-80229:
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

CVE-2026-19931:
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

CVE-2026-18924:
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

CVE-2026-13608:
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

Issue Correction:
Run dnf update curl or dnf update --advisory ALAS2027-2026-192 to update your system.

New Packages:

aarch64:
    libcurl-debuginfo-8.22.0-1.amzn2027.0.1.aarch64
    curl-debuginfo-8.22.0-1.amzn2027.0.1.aarch64
    libcurl-minimal-debuginfo-8.22.0-1.amzn2027.0.1.aarch64
    curl-8.22.0-1.amzn2027.0.1.aarch64
    libcurl-8.22.0-1.amzn2027.0.1.aarch64
    libcurl-minimal-8.22.0-1.amzn2027.0.1.aarch64
    curl-debugsource-8.22.0-1.amzn2027.0.1.aarch64
    libcurl-devel-8.22.0-1.amzn2027.0.1.aarch64

src:
    curl-8.22.0-1.amzn2027.0.1.src

x86_64:
    libcurl-minimal-debuginfo-8.22.0-1.amzn2027.0.1.x86_64
    curl-debuginfo-8.22.0-1.amzn2027.0.1.x86_64
    libcurl-minimal-8.22.0-1.amzn2027.0.1.x86_64
    libcurl-8.22.0-1.amzn2027.0.1.x86_64
    curl-debugsource-8.22.0-1.amzn2027.0.1.x86_64
    curl-8.22.0-1.amzn2027.0.1.x86_64
    libcurl-devel-8.22.0-1.amzn2027.0.1.x86_64
    libcurl-debuginfo-8.22.0-1.amzn2027.0.1.x86_64