{"id":"SUSE-SU-2026:5071-1","summary":"Security update for curl","details":"This update for curl fixes the following issues:\n\n- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).\n- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).\n- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).\n- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).\n- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).\n- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).\n- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).\n- CVE-2026-92389: TFTP direction confusion (bsc#1285015).\n- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).\n- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).\n","modified":"2026-11-03T22:45:04.822915241Z","published":"2026-11-03T08:14:35Z","related":["CVE-2026-11856","CVE-2026-12064","CVE-2026-19931","CVE-2026-8458","CVE-2026-86409","CVE-2026-86410","CVE-2026-86414","CVE-2026-87864","CVE-2026-8932","CVE-2026-92388","CVE-2026-92389","CVE-2026-92391","CVE-2026-94266"],"upstream":["CVE-2026-11856","CVE-2026-12064","CVE-2026-19931","CVE-2026-8458","CVE-2026-86409","CVE-2026-86410","CVE-2026-86414","CVE-2026-87864","CVE-2026-8932","CVE-2026-92388","CVE-2026-92389","CVE-2026-92391","CVE-2026-94266"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265071-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268414"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268426"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268427"},{"type":"REPORT","url":"https://bugzilla.suse.com/1277478"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285010"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285013"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285015"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285016"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285021"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285026"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285030"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285031"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-11856"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-12064"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-19931"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-8458"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-86409"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-86410"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-86414"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-87864"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-8932"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92388"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92389"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92391"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-94266"}],"affected":[{"package":{"name":"curl","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","purl":"pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"ecosystem_specific":{"binaries":[{"libcurl-devel":"8.0.1-11.134.1","libcurl4":"8.0.1-11.134.1","libcurl4-32bit":"8.0.1-11.134.1","curl":"8.0.1-11.134.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5071-1.json"}},{"package":{"name":"curl","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","purl":"pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.134.1"}]}],"ecosystem_specific":{"binaries":[{"libcurl4-32bit":"8.0.1-11.134.1","curl":"8.0.1-11.134.1","libcurl-devel":"8.0.1-11.134.1","libcurl4":"8.0.1-11.134.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5071-1.json"}}],"schema_version":"1.9.2"}