Homepage

Comparison Using Wrong Factors The advisory has been revoked - it doesn't affect any version of package s390utils-chreipl-fcp-mpath  (opens in a new tab)

Threat Intelligence

EPSS
0.4% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-S390UTILSCHREIPLFCPMPATH-19690159
  • published12 Sept 2026
  • disclosed3 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Jul 2026

CVE-2026-8932  (opens in a new tab)
CWE-1025  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream s390utils-chreipl-fcp-mpath package and not the s390utils-chreipl-fcp-mpath package as distributed by Centos.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.