OPENSUSE-SU-2026:21272-1

Advisory lineage Upstream: 10 Downstream: 0
Published: 08 Jul 2026, 13:46
Last modified:11 Jul 2026, 18:24

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Jul 2026, 13:46
Published
Vulnerability first disclosed
11 Jul 2026, 18:24
Last Modified
Vulnerability information updated

Description

Security update for curl This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402). - CVE-2026-8458: wrong reuse for different services (bsc#1268407). - CVE-2026-8924: traling dot domain super cookie (bsc#1268409). - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413). - CVE-2026-9079: stale proxy password leak (bsc#1268415). - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416). - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417). - CVE-2026-9547: SSH improper host validation (bsc#1268420). - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422). - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Affected Systems

  • opensuse•curl&distro=openSUSE Leap 16.0

    < 8.14.1-160000.8.1

References (20)