OPENSUSE-SU-2026:21272-1
Vulnerability from csaf_opensuse - Published: 2026-07-08 13:46 - Updated: 2026-09-16 21:43Summary
Security update for curl
Severity
Important
Notes
Title of the patch: Security update for curl
Description of the patch: This update for curl fixes the following issues
- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
Patchnames: openSUSE-Leap-16.0-1187
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
important
7.4 (High)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
15 products, the same list as for
CVE-2026-10536
Threats
Impact
important
References
43 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1187",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21272-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1268402",
"url": "https://bugzilla.suse.com/1268402"
},
{
"category": "self",
"summary": "SUSE Bug 1268407",
"url": "https://bugzilla.suse.com/1268407"
},
{
"category": "self",
"summary": "SUSE Bug 1268409",
"url": "https://bugzilla.suse.com/1268409"
},
{
"category": "self",
"summary": "SUSE Bug 1268413",
"url": "https://bugzilla.suse.com/1268413"
},
{
"category": "self",
"summary": "SUSE Bug 1268415",
"url": "https://bugzilla.suse.com/1268415"
},
{
"category": "self",
"summary": "SUSE Bug 1268416",
"url": "https://bugzilla.suse.com/1268416"
},
{
"category": "self",
"summary": "SUSE Bug 1268417",
"url": "https://bugzilla.suse.com/1268417"
},
{
"category": "self",
"summary": "SUSE Bug 1268420",
"url": "https://bugzilla.suse.com/1268420"
},
{
"category": "self",
"summary": "SUSE Bug 1268422",
"url": "https://bugzilla.suse.com/1268422"
},
{
"category": "self",
"summary": "SUSE Bug 1268427",
"url": "https://bugzilla.suse.com/1268427"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-10536 page",
"url": "https://www.suse.com/security/cve/CVE-2026-10536/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-12064 page",
"url": "https://www.suse.com/security/cve/CVE-2026-12064/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8286 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8286/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8458 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8924 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8924/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-8927 page",
"url": "https://www.suse.com/security/cve/CVE-2026-8927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9079 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9080 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9080/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9545 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9545/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-9547 page",
"url": "https://www.suse.com/security/cve/CVE-2026-9547/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-09-16T21:43:13Z",
"generator": {
"date": "2026-07-08T13:46:40Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21272-1",
"initial_release_date": "2026-07-08T13:46:40Z",
"revision_history": [
{
"date": "2026-07-08T13:46:40Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T16:13:33Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:41:25Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:43:13Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.8.1.aarch64",
"product": {
"name": "curl-8.14.1-160000.8.1.aarch64",
"product_id": "curl-8.14.1-160000.8.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.14.1-160000.8.1?arch=aarch64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.8.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-160000.8.1.aarch64",
"product_id": "libcurl-devel-8.14.1-160000.8.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.14.1-160000.8.1?arch=aarch64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.8.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-160000.8.1.aarch64",
"product_id": "libcurl4-8.14.1-160000.8.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.14.1-160000.8.1?arch=aarch64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-fish-completion-8.14.1-160000.8.1.noarch",
"product": {
"name": "curl-fish-completion-8.14.1-160000.8.1.noarch",
"product_id": "curl-fish-completion-8.14.1-160000.8.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.14.1-160000.8.1?arch=noarch\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-160000.8.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-160000.8.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-160000.8.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.14.1-160000.8.1?arch=noarch\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.14.1-160000.8.1?arch=noarch\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.8.1.ppc64le",
"product": {
"name": "curl-8.14.1-160000.8.1.ppc64le",
"product_id": "curl-8.14.1-160000.8.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.14.1-160000.8.1?arch=ppc64le\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.8.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-160000.8.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-160000.8.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.14.1-160000.8.1?arch=ppc64le\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.8.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-160000.8.1.ppc64le",
"product_id": "libcurl4-8.14.1-160000.8.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.14.1-160000.8.1?arch=ppc64le\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.8.1.s390x",
"product": {
"name": "curl-8.14.1-160000.8.1.s390x",
"product_id": "curl-8.14.1-160000.8.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.14.1-160000.8.1?arch=s390x\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.8.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-160000.8.1.s390x",
"product_id": "libcurl-devel-8.14.1-160000.8.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.14.1-160000.8.1?arch=s390x\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.8.1.s390x",
"product": {
"name": "libcurl4-8.14.1-160000.8.1.s390x",
"product_id": "libcurl4-8.14.1-160000.8.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.14.1-160000.8.1?arch=s390x\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.8.1.x86_64",
"product": {
"name": "curl-8.14.1-160000.8.1.x86_64",
"product_id": "curl-8.14.1-160000.8.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.14.1-160000.8.1?arch=x86_64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.8.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-160000.8.1.x86_64",
"product_id": "libcurl-devel-8.14.1-160000.8.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.14.1-160000.8.1?arch=x86_64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.8.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-160000.8.1.x86_64",
"product_id": "libcurl4-8.14.1-160000.8.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.14.1-160000.8.1?arch=x86_64\u0026upstream=curl-8.14.1-160000.8.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.8.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64"
},
"product_reference": "curl-8.14.1-160000.8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.8.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le"
},
"product_reference": "curl-8.14.1-160000.8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.8.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x"
},
"product_reference": "curl-8.14.1-160000.8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.8.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64"
},
"product_reference": "curl-8.14.1-160000.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.14.1-160000.8.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch"
},
"product_reference": "curl-fish-completion-8.14.1-160000.8.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.14.1-160000.8.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch"
},
"product_reference": "curl-zsh-completion-8.14.1-160000.8.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.8.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-160000.8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.8.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-160000.8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.8.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-160000.8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.8.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-160000.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.14.1-160000.8.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch"
},
"product_reference": "libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.8.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-160000.8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.8.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-160000.8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.8.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x"
},
"product_reference": "libcurl4-8.14.1-160000.8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.8.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-160000.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-10536",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-10536"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-10536",
"url": "https://www.suse.com/security/cve/CVE-2026-10536"
},
{
"category": "external",
"summary": "SUSE Bug 1268422 for CVE-2026-10536",
"url": "https://bugzilla.suse.com/1268422"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-10536"
},
{
"cve": "CVE-2026-12064",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-12064"
}
],
"notes": [
{
"category": "general",
"text": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-12064",
"url": "https://www.suse.com/security/cve/CVE-2026-12064"
},
{
"category": "external",
"summary": "SUSE Bug 1268427 for CVE-2026-12064",
"url": "https://bugzilla.suse.com/1268427"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "important"
}
],
"title": "CVE-2026-12064"
},
{
"cve": "CVE-2026-8286",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8286"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8286",
"url": "https://www.suse.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "SUSE Bug 1268402 for CVE-2026-8286",
"url": "https://bugzilla.suse.com/1268402"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "important"
}
],
"title": "CVE-2026-8286"
},
{
"cve": "CVE-2026-8458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8458"
}
],
"notes": [
{
"category": "general",
"text": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8458",
"url": "https://www.suse.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "SUSE Bug 1268407 for CVE-2026-8458",
"url": "https://bugzilla.suse.com/1268407"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-8458"
},
{
"cve": "CVE-2026-8924",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8924"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in curl\u0027s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8924",
"url": "https://www.suse.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "SUSE Bug 1268409 for CVE-2026-8924",
"url": "https://bugzilla.suse.com/1268409"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "important"
}
],
"title": "CVE-2026-8924"
},
{
"cve": "CVE-2026-8927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-8927"
}
],
"notes": [
{
"category": "general",
"text": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-8927",
"url": "https://www.suse.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "SUSE Bug 1263440 for CVE-2026-8927",
"url": "https://bugzilla.suse.com/1263440"
},
{
"category": "external",
"summary": "SUSE Bug 1268413 for CVE-2026-8927",
"url": "https://bugzilla.suse.com/1268413"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-8927"
},
{
"cve": "CVE-2026-9079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9079"
}
],
"notes": [
{
"category": "general",
"text": "libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9079",
"url": "https://www.suse.com/security/cve/CVE-2026-9079"
},
{
"category": "external",
"summary": "SUSE Bug 1268415 for CVE-2026-9079",
"url": "https://bugzilla.suse.com/1268415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "important"
}
],
"title": "CVE-2026-9079"
},
{
"cve": "CVE-2026-9080",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9080"
}
],
"notes": [
{
"category": "general",
"text": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer\u0027s\nmemory has been freed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9080",
"url": "https://www.suse.com/security/cve/CVE-2026-9080"
},
{
"category": "external",
"summary": "SUSE Bug 1268416 for CVE-2026-9080",
"url": "https://bugzilla.suse.com/1268416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-9080"
},
{
"cve": "CVE-2026-9545",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9545"
}
],
"notes": [
{
"category": "general",
"text": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker\u0027s impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request\u0027s bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9545",
"url": "https://www.suse.com/security/cve/CVE-2026-9545"
},
{
"category": "external",
"summary": "SUSE Bug 1268417 for CVE-2026-9545",
"url": "https://bugzilla.suse.com/1268417"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "moderate"
}
],
"title": "CVE-2026-9545"
},
{
"cve": "CVE-2026-9547",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-9547"
}
],
"notes": [
{
"category": "general",
"text": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-9547",
"url": "https://www.suse.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "SUSE Bug 1268420 for CVE-2026-9547",
"url": "https://bugzilla.suse.com/1268420"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.8.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.8.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T13:46:40Z",
"details": "important"
}
],
"title": "CVE-2026-9547"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…