SB2026082704 - SUSE update for curl
Published: August 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-10536)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in libcurl HTTP/2 stream-dependency handling when resetting and cleaning up an easy handle configured with HTTP/2 stream dependencies. A local user can invoke curl_easy_reset() and then curl_easy_cleanup() on such a handle to cause a denial of service.
The issue only affects libcurl and requires use of the rarely used HTTP/2 stream-dependency options CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E.
2) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-7168)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to authentication bypass by capture-replay. A remote attacker can leak and reuse Digest proxy authentication state across proxies to impersonate the client.
3) Improper Certificate Validation (CVE-ID: CVE-2026-8286)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS certificate validation.
The vulnerability exists due to improper certificate validation in connection reuse logic for STARTTLS-enabled protocol handling when reusing an existing live connection for a new transfer. A remote attacker can cause a transfer to reuse a connection with mismatched TLS settings to bypass TLS certificate validation.
This affects transfers using IMAP, POP3, SMTP, FTP, or LDAP schemes that begin in cleartext and are upgraded to TLS with STARTTLS.
4) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-8458)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to expose data to the wrong session.
The vulnerability exists due to exposure of data element to wrong session in libcurl connection reuse logic when reusing Negotiate-authenticated connections across different services. A remote user can issue a request that wrongfully reuses an existing authenticated connection to expose data to the wrong session.
The issue only occurs when using the same hostname, port number, and credentials, and when the previous connection remains alive in the connection pool.
5) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-8924)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie domain validation in cookie parsing logic when processing a cookie with a trailing-dot domain for a trailing-dot hostname. A remote attacker can send a specially crafted HTTP response that sets a super cookie to disclose sensitive information.
This issue is exploitable through both libcurl and the curl command line tool, and it bypasses the Public Suffix List check.
6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-9547)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a man-in-the-middle attack.
The vulnerability exists due to improper validation of certificate with host mismatch in the CURLOPT_SSH_KEYFUNCTION callback when validating SSH host keys for SCP:// or SFTP:// transfers. A remote attacker can present a host key type that does not match the key type already recorded for the host in the known_hosts file to perform a man-in-the-middle attack.
Only libcurl-based applications built with the libssh backend and using the callback are vulnerable. The curl command line tool is not affected.
Remediation
Install update from vendor's website.