Security update for curl
This update for curl fixes the following issues: - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191) - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757) - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348) Other fixes: - tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for curl fixes the following issues: - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191) - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757) - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348) Other fixes: - tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1249191
- https://bugzilla.suse.com/1249348
- https://bugzilla.suse.com/1249367
- https://bugzilla.suse.com/1253757
- https://www.suse.com/security/cve/CVE-2025-10148
- https://www.suse.com/security/cve/CVE-2025-11563
- https://www.suse.com/security/cve/CVE-2025-9086
- https://www.suse.com/support/update/announcement/2025/suse-su-202521077-1/