{
  "cves": [
    "CVE-2026-11856",
    "CVE-2026-8458",
    "CVE-2026-8924",
    "CVE-2026-8927",
    "CVE-2026-8932"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[7.61.1-34.el8_10.18]\n- fix incomplete mTLS config in connection reuse (CVE-2026-8932)\n\n[7.61.1-34.el8_10.17]\n- fix cookie injection via trailing dot super cookies (CVE-2026-8924)\n- fix digest auth state leak on origin or credential change (CVE-2026-11856)\n\n[7.61.1-34.el8_10.16]\n- add sasl service name to connection reuse checks (CVE-2026-8458)\n\n[7.61.1-34.el8_10.15]\n- detect proxy changes read from environment (CVE-2026-8927)\n\n[7.61.1-34.el8_10.14]\n- h2: allow 100 streams by default (RHEL-232829)\n- tests: disable 1701 (h2c POST Upgrade vs nghttpx CVE-2026-58055)",
  "id": "ELSA-2026-92368",
  "ovalId": "oval:com.oracle.elsa:def:202692368",
  "source": "oracle_linux",
  "title": "ELSA-2026-92368:  curl security, bug fix, and enhancement update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-92368.html"
}