[El-errata] ELSA-2026-55439 Important: Oracle Linux 9 curl security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-55439

http://linux.oracle.com/errata/ELSA-2026-55439.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
curl-7.76.1-40.el9_8.5.x86_64.rpm
curl-minimal-7.76.1-40.el9_8.5.x86_64.rpm
libcurl-7.76.1-40.el9_8.5.i686.rpm
libcurl-7.76.1-40.el9_8.5.x86_64.rpm
libcurl-devel-7.76.1-40.el9_8.5.i686.rpm
libcurl-devel-7.76.1-40.el9_8.5.x86_64.rpm
libcurl-minimal-7.76.1-40.el9_8.5.i686.rpm
libcurl-minimal-7.76.1-40.el9_8.5.x86_64.rpm

aarch64:
curl-7.76.1-40.el9_8.5.aarch64.rpm
curl-minimal-7.76.1-40.el9_8.5.aarch64.rpm
libcurl-7.76.1-40.el9_8.5.aarch64.rpm
libcurl-devel-7.76.1-40.el9_8.5.aarch64.rpm
libcurl-minimal-7.76.1-40.el9_8.5.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/curl-7.76.1-40.el9_8.5.src.rpm

Related CVEs:

CVE-2026-1965
CVE-2026-3783
CVE-2026-8286
CVE-2026-9547




Description of changes:

[7.76.1-40.el9_8.5]
- fix missing %patch macros for Patch46 and Patch47

[7.76.1-40.el9_8.4]
- fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965)
- fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783)
- tests: disable flaky test 1206 on x86_64 (FTP PORT timeout under valgrind)

[7.76.1-40.3]
- tests: disable flaky tests 3000, 3001 on i686 (stunnel startup race)

[7.76.1-40.1]
- fix SSH host key mismatch on type difference (CVE-2026-9547)
- fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286)