SUSE-SU-2026:5069-1: curl&distro=SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:5069-1 is a vulnerability in curl&distro=SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 03-11-2026
   PublishedVulnerability first disclosed.
2. 03-11-2026
   Last modifiedVulnerability information updated.

Description

Security update for curl This update for curl fixes the following issues: - CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414). - CVE-2026-9546: sending old referer (bsc#1268419). - CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423). - CVE-2026-11564: Native CA trust persist (bsc#1268424). - CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425). - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426). - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427). - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477). - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478). - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482). - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173). - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031). - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030). - CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029). - CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028). - CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027). - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026). - CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024). - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023). - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022). - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021). - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018). - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017). - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016). - CVE-2026-92389: TFTP direction confusion (bsc#1285015). - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014). - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013). - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012). - CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011). - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010). - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008). Changes for curl: - Updated to version 8.22.0. (jsc#PED-16984)

No weakness data has been published for this record.