Security update for curl
This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402). - CVE-2026-8458: wrong reuse for different services (bsc#1268407). - CVE-2026-8924: traling dot domain super cookie (bsc#1268409). - CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413). - CVE-2026-9079: stale proxy password leak (bsc#1268415). - CVE-2026-9080: UAF after pause in socket callback (bsc#1268416). - CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417). - CVE-2026-9547: SSH improper host validation (bsc#1268420). - CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422). - CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1268402
- https://bugzilla.suse.com/1268407
- https://bugzilla.suse.com/1268409
- https://bugzilla.suse.com/1268413
- https://bugzilla.suse.com/1268415
- https://bugzilla.suse.com/1268416
- https://bugzilla.suse.com/1268417
- https://bugzilla.suse.com/1268420
- https://bugzilla.suse.com/1268422
- https://bugzilla.suse.com/1268427
- https://www.suse.com/security/cve/CVE-2026-10536
- https://www.suse.com/security/cve/CVE-2026-12064
- https://www.suse.com/security/cve/CVE-2026-8286
- https://www.suse.com/security/cve/CVE-2026-8458
- https://www.suse.com/security/cve/CVE-2026-8924
- https://www.suse.com/security/cve/CVE-2026-8927
- https://www.suse.com/security/cve/CVE-2026-9079
- https://www.suse.com/security/cve/CVE-2026-9080
- https://www.suse.com/security/cve/CVE-2026-9545
- https://www.suse.com/security/cve/CVE-2026-9547