SB2026011367 - SUSE update for curl 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026011367

SB2026011367 - SUSE update for curl

Published: January 13, 2026

Security Bulletin ID SB2026011367
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Unsynchronized access to shared data in a multithreaded context (CVE-ID: CVE-2025-14017)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when performing multithreaded LDAPS transfers (LDAP over TLS) with libcurl. Changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. For example, disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well, leading to a MitM attacks against other websites.


Remediation

Install update from vendor's website.

References