OPENSUSE-SU-2026:11230-1
Vulnerability from csaf_opensuse - Published: 2026-07-09 00:00 - Updated: 2026-09-16 21:20Summary
curl-8.21.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: curl-8.21.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11230
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
36 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
7.5 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
7.5 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-10536
Threats
Impact
important
References
57 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "curl-8.21.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11230",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11230-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-10536 page",
"url": "https://www.suse.com/security/cve/CVE-2026-10536/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-11352 page",
"url": "https://www.suse.com/security/cve/CVE-2026-11352/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-11564 page",
"url": "https://www.suse.com/security/cve/CVE-2026-11564/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-11586 page",
"url": "https://www.suse.com/security/cve/CVE-2026-11586/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-11856 page",
"url": "https://www.suse.com/security/cve/CVE-2026-11856/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12064 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12064/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8286 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8286/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8458 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8924 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8924/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8925 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8925/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8926 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8926/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8927 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8932 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8932/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9079 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9080 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9080/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9545 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9545/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9546 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9546/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9547 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9547/"
}
],
"title": "curl-8.21.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-16T21:20:52Z",
"generator": {
"date": "2026-07-09T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11230-1",
"initial_release_date": "2026-07-09T00:00:00Z",
"revision_history": [
{
"date": "2026-07-09T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T16:12:31Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:18:29Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:20:52Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.21.0-1.1.aarch64",
"product": {
"name": "curl-8.21.0-1.1.aarch64",
"product_id": "curl-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.21.0-1.1.aarch64",
"product": {
"name": "curl-fish-completion-8.21.0-1.1.aarch64",
"product_id": "curl-fish-completion-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.21.0-1.1.aarch64",
"product": {
"name": "curl-zsh-completion-8.21.0-1.1.aarch64",
"product_id": "curl-zsh-completion-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.21.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-8.21.0-1.1.aarch64",
"product_id": "libcurl-devel-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.21.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-32bit-8.21.0-1.1.aarch64",
"product_id": "libcurl-devel-32bit-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.21.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-doc-8.21.0-1.1.aarch64",
"product_id": "libcurl-devel-doc-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.21.0-1.1.aarch64",
"product": {
"name": "libcurl4-8.21.0-1.1.aarch64",
"product_id": "libcurl4-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.21.0-1.1.aarch64",
"product": {
"name": "libcurl4-32bit-8.21.0-1.1.aarch64",
"product_id": "libcurl4-32bit-8.21.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.21.0-1.1?arch=aarch64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-8.21.0-1.1.aarch64",
"product": {
"name": "wcurl-8.21.0-1.1.aarch64",
"product_id": "wcurl-8.21.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.21.0-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.21.0-1.1.ppc64le",
"product": {
"name": "curl-8.21.0-1.1.ppc64le",
"product_id": "curl-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.21.0-1.1.ppc64le",
"product": {
"name": "curl-fish-completion-8.21.0-1.1.ppc64le",
"product_id": "curl-fish-completion-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.21.0-1.1.ppc64le",
"product": {
"name": "curl-zsh-completion-8.21.0-1.1.ppc64le",
"product_id": "curl-zsh-completion-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.21.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-8.21.0-1.1.ppc64le",
"product_id": "libcurl-devel-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"product_id": "libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.21.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-doc-8.21.0-1.1.ppc64le",
"product_id": "libcurl-devel-doc-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.21.0-1.1.ppc64le",
"product": {
"name": "libcurl4-8.21.0-1.1.ppc64le",
"product_id": "libcurl4-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.21.0-1.1.ppc64le",
"product": {
"name": "libcurl4-32bit-8.21.0-1.1.ppc64le",
"product_id": "libcurl4-32bit-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.21.0-1.1?arch=ppc64le\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-8.21.0-1.1.ppc64le",
"product": {
"name": "wcurl-8.21.0-1.1.ppc64le",
"product_id": "wcurl-8.21.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.21.0-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.21.0-1.1.s390x",
"product": {
"name": "curl-8.21.0-1.1.s390x",
"product_id": "curl-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.21.0-1.1.s390x",
"product": {
"name": "curl-fish-completion-8.21.0-1.1.s390x",
"product_id": "curl-fish-completion-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.21.0-1.1.s390x",
"product": {
"name": "curl-zsh-completion-8.21.0-1.1.s390x",
"product_id": "curl-zsh-completion-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.21.0-1.1.s390x",
"product": {
"name": "libcurl-devel-8.21.0-1.1.s390x",
"product_id": "libcurl-devel-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.21.0-1.1.s390x",
"product": {
"name": "libcurl-devel-32bit-8.21.0-1.1.s390x",
"product_id": "libcurl-devel-32bit-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.21.0-1.1.s390x",
"product": {
"name": "libcurl-devel-doc-8.21.0-1.1.s390x",
"product_id": "libcurl-devel-doc-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.21.0-1.1.s390x",
"product": {
"name": "libcurl4-8.21.0-1.1.s390x",
"product_id": "libcurl4-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.21.0-1.1.s390x",
"product": {
"name": "libcurl4-32bit-8.21.0-1.1.s390x",
"product_id": "libcurl4-32bit-8.21.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.21.0-1.1?arch=s390x\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-8.21.0-1.1.s390x",
"product": {
"name": "wcurl-8.21.0-1.1.s390x",
"product_id": "wcurl-8.21.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.21.0-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.21.0-1.1.x86_64",
"product": {
"name": "curl-8.21.0-1.1.x86_64",
"product_id": "curl-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.21.0-1.1.x86_64",
"product": {
"name": "curl-fish-completion-8.21.0-1.1.x86_64",
"product_id": "curl-fish-completion-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.21.0-1.1.x86_64",
"product": {
"name": "curl-zsh-completion-8.21.0-1.1.x86_64",
"product_id": "curl-zsh-completion-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.21.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-8.21.0-1.1.x86_64",
"product_id": "libcurl-devel-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.21.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.21.0-1.1.x86_64",
"product_id": "libcurl-devel-32bit-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.21.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-doc-8.21.0-1.1.x86_64",
"product_id": "libcurl-devel-doc-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.21.0-1.1.x86_64",
"product": {
"name": "libcurl4-8.21.0-1.1.x86_64",
"product_id": "libcurl4-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.21.0-1.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.21.0-1.1.x86_64",
"product_id": "libcurl4-32bit-8.21.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.21.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.21.0-1.1?arch=x86_64\u0026upstream=curl-8.21.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-8.21.0-1.1.x86_64",
"product": {
"name": "wcurl-8.21.0-1.1.x86_64",
"product_id": "wcurl-8.21.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.21.0-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64"
},
"product_reference": "curl-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le"
},
"product_reference": "curl-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.21.0-1.1.s390x"
},
"product_reference": "curl-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64"
},
"product_reference": "curl-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64"
},
"product_reference": "curl-fish-completion-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le"
},
"product_reference": "curl-fish-completion-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x"
},
"product_reference": "curl-fish-completion-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64"
},
"product_reference": "curl-fish-completion-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64"
},
"product_reference": "curl-zsh-completion-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le"
},
"product_reference": "curl-zsh-completion-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x"
},
"product_reference": "curl-zsh-completion-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64"
},
"product_reference": "curl-zsh-completion-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x"
},
"product_reference": "libcurl-devel-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-32bit-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x"
},
"product_reference": "libcurl-devel-32bit-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-32bit-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-doc-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-doc-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x"
},
"product_reference": "libcurl-devel-doc-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-doc-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64"
},
"product_reference": "libcurl4-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le"
},
"product_reference": "libcurl4-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x"
},
"product_reference": "libcurl4-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64"
},
"product_reference": "libcurl4-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64"
},
"product_reference": "libcurl4-32bit-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le"
},
"product_reference": "libcurl4-32bit-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x"
},
"product_reference": "libcurl4-32bit-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64"
},
"product_reference": "libcurl4-32bit-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.21.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64"
},
"product_reference": "wcurl-8.21.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.21.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le"
},
"product_reference": "wcurl-8.21.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.21.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x"
},
"product_reference": "wcurl-8.21.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.21.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
},
"product_reference": "wcurl-8.21.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-10536",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-10536"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-10536",
"url": "https://www.suse.com/security/cve/CVE-2026-10536"
},
{
"category": "external",
"summary": "SUSE Bug 1268422 for CVE-2026-10536",
"url": "https://bugzilla.suse.com/1268422"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-10536"
},
{
"cve": "CVE-2026-11352",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-11352"
}
],
"notes": [
{
"category": "general",
"text": "An issue in curl\u0027s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-11352",
"url": "https://www.suse.com/security/cve/CVE-2026-11352"
},
{
"category": "external",
"summary": "SUSE Bug 1268423 for CVE-2026-11352",
"url": "https://bugzilla.suse.com/1268423"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-11352"
},
{
"cve": "CVE-2026-11564",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-11564"
}
],
"notes": [
{
"category": "general",
"text": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-11564",
"url": "https://www.suse.com/security/cve/CVE-2026-11564"
},
{
"category": "external",
"summary": "SUSE Bug 1268424 for CVE-2026-11564",
"url": "https://bugzilla.suse.com/1268424"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-11564"
},
{
"cve": "CVE-2026-11586",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-11586"
}
],
"notes": [
{
"category": "general",
"text": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-11586",
"url": "https://www.suse.com/security/cve/CVE-2026-11586"
},
{
"category": "external",
"summary": "SUSE Bug 1268425 for CVE-2026-11586",
"url": "https://bugzilla.suse.com/1268425"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-11586"
},
{
"cve": "CVE-2026-11856",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-11856"
}
],
"notes": [
{
"category": "general",
"text": "Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-11856",
"url": "https://www.suse.com/security/cve/CVE-2026-11856"
},
{
"category": "external",
"summary": "SUSE Bug 1268426 for CVE-2026-11856",
"url": "https://bugzilla.suse.com/1268426"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-11856"
},
{
"cve": "CVE-2026-12064",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12064"
}
],
"notes": [
{
"category": "general",
"text": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12064",
"url": "https://www.suse.com/security/cve/CVE-2026-12064"
},
{
"category": "external",
"summary": "SUSE Bug 1268427 for CVE-2026-12064",
"url": "https://bugzilla.suse.com/1268427"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-12064"
},
{
"cve": "CVE-2026-8286",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8286"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8286",
"url": "https://www.suse.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "SUSE Bug 1268402 for CVE-2026-8286",
"url": "https://bugzilla.suse.com/1268402"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-8286"
},
{
"cve": "CVE-2026-8458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8458"
}
],
"notes": [
{
"category": "general",
"text": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8458",
"url": "https://www.suse.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "SUSE Bug 1268407 for CVE-2026-8458",
"url": "https://bugzilla.suse.com/1268407"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-8458"
},
{
"cve": "CVE-2026-8924",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8924"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in curl\u0027s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8924",
"url": "https://www.suse.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "SUSE Bug 1268409 for CVE-2026-8924",
"url": "https://bugzilla.suse.com/1268409"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-8924"
},
{
"cve": "CVE-2026-8925",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8925"
}
],
"notes": [
{
"category": "general",
"text": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8925",
"url": "https://www.suse.com/security/cve/CVE-2026-8925"
},
{
"category": "external",
"summary": "SUSE Bug 1268411 for CVE-2026-8925",
"url": "https://bugzilla.suse.com/1268411"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-8925"
},
{
"cve": "CVE-2026-8926",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8926"
}
],
"notes": [
{
"category": "general",
"text": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8926",
"url": "https://www.suse.com/security/cve/CVE-2026-8926"
},
{
"category": "external",
"summary": "SUSE Bug 1268412 for CVE-2026-8926",
"url": "https://bugzilla.suse.com/1268412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-8926"
},
{
"cve": "CVE-2026-8927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8927"
}
],
"notes": [
{
"category": "general",
"text": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8927",
"url": "https://www.suse.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "SUSE Bug 1263440 for CVE-2026-8927",
"url": "https://bugzilla.suse.com/1263440"
},
{
"category": "external",
"summary": "SUSE Bug 1268413 for CVE-2026-8927",
"url": "https://bugzilla.suse.com/1268413"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-8927"
},
{
"cve": "CVE-2026-8932",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8932"
}
],
"notes": [
{
"category": "general",
"text": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8932",
"url": "https://www.suse.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "SUSE Bug 1268414 for CVE-2026-8932",
"url": "https://bugzilla.suse.com/1268414"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-8932"
},
{
"cve": "CVE-2026-9079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9079"
}
],
"notes": [
{
"category": "general",
"text": "libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9079",
"url": "https://www.suse.com/security/cve/CVE-2026-9079"
},
{
"category": "external",
"summary": "SUSE Bug 1268415 for CVE-2026-9079",
"url": "https://bugzilla.suse.com/1268415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-9079"
},
{
"cve": "CVE-2026-9080",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9080"
}
],
"notes": [
{
"category": "general",
"text": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer\u0027s\nmemory has been freed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9080",
"url": "https://www.suse.com/security/cve/CVE-2026-9080"
},
{
"category": "external",
"summary": "SUSE Bug 1268416 for CVE-2026-9080",
"url": "https://bugzilla.suse.com/1268416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-9080"
},
{
"cve": "CVE-2026-9545",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9545"
}
],
"notes": [
{
"category": "general",
"text": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker\u0027s impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request\u0027s bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9545",
"url": "https://www.suse.com/security/cve/CVE-2026-9545"
},
{
"category": "external",
"summary": "SUSE Bug 1268417 for CVE-2026-9545",
"url": "https://bugzilla.suse.com/1268417"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-9545"
},
{
"cve": "CVE-2026-9546",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9546"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9546",
"url": "https://www.suse.com/security/cve/CVE-2026-9546"
},
{
"category": "external",
"summary": "SUSE Bug 1268419 for CVE-2026-9546",
"url": "https://bugzilla.suse.com/1268419"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-9546"
},
{
"cve": "CVE-2026-9547",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9547"
}
],
"notes": [
{
"category": "general",
"text": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9547",
"url": "https://www.suse.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "SUSE Bug 1268420 for CVE-2026-9547",
"url": "https://bugzilla.suse.com/1268420"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.21.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.21.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-9547"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…