OPENSUSE-SU-2025:20090-1
Advisory lineage Upstream: 3 Downstream: 0
Published: 26 Nov 2025, 14:30
Last modified:23 Mar 2026, 04:54
Vulnerability Summary
Overall Risk (default)
minimal
0/100 CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
26 Nov 2025, 14:30
Published
Vulnerability first disclosed
23 Mar 2026, 04:54
Last Modified
Vulnerability information updated
Description
Security update for curl This update for curl fixes the following issues: - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191) - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757) - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348) Other fixes: - tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)
Affected Systems
- opensuse•curl&distro=openSUSE Leap 16.0
< 8.14.1-160000.3.1