SUSE-SU-2025:21145-1

Advisory lineage Upstream: 3 Downstream: 0
Published: 26 Nov 2025, 14:28
Last modified:23 Mar 2026, 04:51

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Nov 2025, 14:28
Published
Vulnerability first disclosed
23 Mar 2026, 04:51
Last Modified
Vulnerability information updated

Description

Security update for curl This update for curl fixes the following issues: - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191) - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757) - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348) Other fixes: - tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)

Affected Systems

  • suse•curl-mini&distro=SUSE Linux Enterprise Server 16.0

    < 8.14.1-160000.3.1

  • suse•curl-mini&distro=SUSE Linux Enterprise Server for SAP applications 16.0

    < 8.14.1-160000.3.1

  • suse•curl&distro=SUSE Linux Enterprise Server 16.0

    < 8.14.1-160000.3.1

  • suse•curl&distro=SUSE Linux Enterprise Server for SAP applications 16.0

    < 8.14.1-160000.3.1

References (8)