SB2026110234 - SUSE update for curl
Published: November 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 vulnerabilities.
1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87863)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to erase persisted HSTS cache entries.
The vulnerability exists due to improper handling of time serialization failures in HSTS cache persistence when saving entries received from an authenticated HTTPS origin. A remote user can supply an HSTS max-age value that the parser accepts but time serialization cannot process to erase persisted HSTS cache entries.
On 64-bit systems, extreme max-age values can produce expiry times within time integer limits but beyond calendar time structure bounds. Cache save errors are silently ignored during cleanup, allowing curl to exit successfully.
2) Insufficiently protected credentials (CVE-ID: CVE-2026-94266)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain sensitive credentials.
The vulnerability exists due to insufficient protection of credentials in the curl_easy_getinfo CURLINFO_EFFECTIVE_URL option when retrieving credentials from a .netrc file. A local user can read credentials exposed in the returned effective URL to obtain sensitive credentials.
Credentials can appear even when neither the original URL nor the redirected URL contains them. The curl command-line option --write-out '%{url_effective}' exposes the same information.
3) Use-after-free (CVE-ID: CVE-2026-92392)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in curl's HTTP/2 upload handling when processing server-supplied stream resets during an upload. A remote attacker can send specially crafted HTTP/2 RST_STREAM frames with the HTTP_1_1_REQUIRED or REFUSED_STREAM reason to execute arbitrary code.
The demonstrated exploitation requires knowledge of the exact curl object layout, target architecture, compatible libc allocator and heap layout, and calibrated leak and symbol offsets. It also depends on nghttp2 and OpenSSL/TLS 1.3 allocation behavior, a pinned CA bundle and input-dependent allocation geometry, and the timing of two parallel transfers. The demonstrated exploit has an approximately 23-byte command constraint.
4) Uncontrolled Recursion (CVE-ID: CVE-2026-92391)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in libcurl's curl_mime_free function when traversing deeply nested multipart MIME structures during cleanup. A local user can construct a deeply nested multipart MIME structure through the public API to cause a denial of service.
Triggering the flaw requires thousands of nested MIME parts, with the exact threshold depending on the system and configuration. The curl command line tool is not affected.
5) External Control of File Name or Path (CVE-ID: CVE-2026-92390)
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite existing local files.
The vulnerability exists due to failure to preserve anti-clobbering protection in the curl command line tool's HTTP response handling when processing responses with --remote-header-name (-J) enabled. A remote attacker can serve a response containing a Content-Disposition filename preceded by an intermediate 103 Early Hints response, or by an ETag header when --etag-save is enabled, to overwrite existing local files.
The flaw affects only the command line tool, not libcurl.
6) Information disclosure (CVE-ID: CVE-2026-92389)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper validation of state transitions against the requested transfer direction in libcurl's TFTP state machine when handling opening server responses to download requests. A remote attacker can send a specially crafted server response that forces the client into transmit mode to disclose sensitive information.
Data is consumed from the handle's persistent CURLOPT_READDATA pointer, which may retain data from unrelated prior operations, such as an HTTP POST request executed on a reused handle. The curl command-line tool is not affected.
7) Use-after-free (CVE-ID: CVE-2026-92388)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.
The vulnerability exists due to use-after-free and type confusion in libcurl's FTP wildcard write callback handling when reusing or cloning an easy handle after a failed FTP wildcard LIST operation. A remote attacker can supply server response bytes that are processed through the incorrectly retained internal listing parser to cause a denial of service and corrupt memory.
Exploitation requires CURLOPT_FTP_WILDCARD to be enabled. The use-after-free read occurs when the original handle is freed before a transfer executes on its duplicate. Type confusion occurs when the application changes CURLOPT_WRITEDATA without also changing CURLOPT_WRITEFUNCTION. The curl command-line tool is not affected.
8) Infinite loop (CVE-ID: CVE-2026-92387)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a loop with an unreachable exit condition in libcurl's FTP, IMAP, POP3, and SMTP control-response handling when processing server responses. A remote attacker can permanently omit the final control-response line to cause a denial of service by bypassing configured transfer timeouts and indefinitely blocking all concurrent transfers bound to the same multi-handle.
Sustaining the loop requires the server to feed data at the client's read speed, requiring a very high network speed or an unusually slow client. The curl command-line tool is not affected.
9) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-92386)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
The vulnerability exists due to improper validation of cookie record length in the Netscape cookie jar writer and parser when writing server-supplied cookies and subsequently loading the cookie jar. A remote attacker can supply a long cookie name and value through an HTTP server response to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
Exploitation requires a subsequent invocation to read the same cookie jar using --cookie. The server cannot determine or control the cookie's relative position in the jar, so the oversized record may affect many, few, or no other cookies.
10) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-8932)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client certificate authentication.
The vulnerability exists due to authentication bypass by primary weakness in libcurl connection reuse logic when reusing a previously established connection after changing mTLS client certificate settings. A remote user can reuse a connection with mismatched client certificate configuration to bypass client certificate authentication.
The issue affects libcurl and does not affect the curl command line tool.
11) Command injection (CVE-ID: CVE-2026-87864)
CWE-ID: CWE-77 - Command injection
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject and execute IMAP commands within an authenticated session.
The vulnerability exists due to improper handling of a length parameter inconsistency in curl's IMAP APPEND implementation when processing uploads. A remote user can supply upload data whose line-ending conversion expands it beyond the advertised literal length to inject and execute IMAP commands within an authenticated session.
Exploitation requires CURLOPT_CRLF to be enabled.
12) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-107929)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause transfers to use an unintended source address.
The vulnerability exists due to omission of source bindings from the connection reuse key in curl's connection reuse logic when processing transfers configured through CURLOPT_INTERFACE or --interface with the if!, host!, or ifhost! prefixes. A local user can initiate a later transfer requesting a different source that silently reuses an existing connection to cause transfers to use an unintended source address.
13) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87862)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain information sent over unencrypted HTTP.
The vulnerability exists due to incorrect discarding of longer-lived child HSTS entries in curl's HSTS cache import functionality when importing an includeSubDomains parent entry before a longer-lived child entry. A remote attacker can take advantage of the loss of HTTPS enforcement after the parent entry expires to obtain information sent over unencrypted HTTP.
14) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86414)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose origin credentials.
The vulnerability exists due to incorrect handling of origin authentication challenges in libcurl's HTTP proxy tunnel handling when processing responses to CONNECT requests. A remote attacker can return an HTTP 401 response with a WWW-Authenticate header instead of the expected HTTP 407 response with a Proxy-Authenticate header to disclose origin credentials.
Exploitation requires the client to use an attacker-controlled HTTP proxy. Exposed credentials can include a Basic authentication password or a Negotiate/Kerberos ticket.
15) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-86410)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass SSH host verification.
The vulnerability exists due to improper initialization of SSH host verification options in the curl command-line tool when following redirects from HTTPS to SFTP or SCP. A remote attacker can return a redirect to an SFTP or SCP destination to bypass SSH host verification.
Exploitation requires redirect following and redirects to SFTP or SCP to be enabled. The requested verification methods specified through --knownhosts, --hostpubsha256, or --hostpubmd5 are not applied to the redirected connection. libcurl is not affected.
16) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86409)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose an access-key identifier and a request-bound signature.
The vulnerability exists due to failure to disable SigV4 authentication in libcurl's SigV4 authentication handling when an application sets CURLOPT_AWS_SIGV4 to NULL and reuses the same easy handle while retaining CURLOPT_USERPWD credentials. A remote attacker can influence the destination URL of a subsequent request to disclose an access-key identifier and a request-bound signature.
The secret key is not transmitted. This flaw is not accessible through the curl command line tool.
17) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-82209)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.
Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.
18) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-80255)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie attribute handling in the Set-Cookie header processing logic when parsing a Set-Cookie header that uses a tab immediately before the Secure attribute. A remote attacker can send a specially crafted Set-Cookie header to disclose sensitive information.
The issue can cause a cookie to be stored without its Secure flag and then be sent over plaintext HTTP on subsequent requests to the same host.
19) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-19931)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause requests to be sent over another user's previously authenticated connection.
The vulnerability exists due to exposure of data element to wrong session in HTTP connection reuse for Negotiate authentication when reusing a connection established with empty credentials. A remote user can issue a request using blank credentials to cause requests to be sent over another user's previously authenticated connection.
This issue affects libcurl and the curl command line tool when Negotiate authentication is used with ambient credentials provided by SSPI or GSSAPI.
20) Use-after-free (CVE-ID: CVE-2026-18924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to use-after-free in libcurl HTTP/2 server push stream handling when processing an HTTPS HTTP/2 server push on a shared connection. A remote attacker can send a server push response sequence to trigger a use-after-free.
The issue affects libcurl only and requires HTTP/2 server push to be enabled and accepted by the application, along with connection sharing.
21) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-11856)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication by replaying Digest authentication state.
The vulnerability exists due to authentication bypass by capture-replay in libcurl Digest authentication handling when reusing the same handle for a second transfer to a different HTTP origin. A remote attacker can receive a request containing an Authorization header intended for another origin to bypass authentication by replaying Digest authentication state.
The issue affects libcurl but not the curl command line tool. The leaked header does not reveal the other origin, and the exposed state allows replay only for the exact path of the captured request.
Remediation
Install update from vendor's website.