Описание
Security update for curl
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated to version 8.22.0. (jsc#PED-16984)
Список пакетов
Container suse/ltss/sle15.6/sle15:latest
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:5069-1
- E-Mail link for SUSE-SU-2026:5069-1
- SUSE Security Ratings
- SUSE Bug 1268414
- SUSE Bug 1268419
- SUSE Bug 1268423
- SUSE Bug 1268424
- SUSE Bug 1268425
- SUSE Bug 1268426
- SUSE Bug 1268427
- SUSE Bug 1277477
- SUSE Bug 1277478
- SUSE Bug 1277482
- SUSE Bug 1278173
- SUSE Bug 1285008
- SUSE Bug 1285010
- SUSE Bug 1285011
- SUSE Bug 1285012
- SUSE Bug 1285013
- SUSE Bug 1285014
Описание
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address
Затронутые продукты
Ссылки
- CVE-2026-107929
- SUSE Bug 1285008
Описание
An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.
Затронутые продукты
Ссылки
- CVE-2026-11352
- SUSE Bug 1268423
Описание
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
Затронутые продукты
Ссылки
- CVE-2026-11564
- SUSE Bug 1268424
Описание
By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.
Затронутые продукты
Ссылки
- CVE-2026-11586
- SUSE Bug 1268425
Описание
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
Затронутые продукты
Ссылки
- CVE-2026-11856
- SUSE Bug 1268426
Описание
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
Затронутые продукты
Ссылки
- CVE-2026-12064
- SUSE Bug 1268427
- SUSE Bug 1285030
Описание
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Затронутые продукты
Ссылки
- CVE-2026-18924
- SUSE Bug 1277477
Описание
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Затронутые продукты
Ссылки
- CVE-2026-19931
- SUSE Bug 1277478
Описание
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Затронутые продукты
Ссылки
- CVE-2026-80255
- SUSE Bug 1277482
Описание
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).
Затронутые продукты
Ссылки
- CVE-2026-82209
- SUSE Bug 1278173
Описание
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.
Затронутые продукты
Ссылки
- CVE-2026-86409
- SUSE Bug 1285031
Описание
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
Затронутые продукты
Ссылки
- CVE-2026-86410
- SUSE Bug 1285030
Описание
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.
Затронутые продукты
Ссылки
- CVE-2026-86411
- SUSE Bug 1285029
Описание
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.
Затронутые продукты
Ссылки
- CVE-2026-86412
- SUSE Bug 1285028
Описание
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there.
Затронутые продукты
Ссылки
- CVE-2026-86413
- SUSE Bug 1285027
Описание
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
Затронутые продукты
Ссылки
- CVE-2026-86414
- SUSE Bug 1285026
Описание
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
Затронутые продукты
Ссылки
- CVE-2026-87861
- SUSE Bug 1285024
Описание
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
Затронутые продукты
Ссылки
- CVE-2026-87862
- SUSE Bug 1285023
Описание
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.
Затронутые продукты
Ссылки
- CVE-2026-87863
- SUSE Bug 1285022
Описание
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
Затронутые продукты
Ссылки
- CVE-2026-87864
- SUSE Bug 1285021
Описание
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Затронутые продукты
Ссылки
- CVE-2026-8932
- SUSE Bug 1268414
Описание
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
Затронутые продукты
Ссылки
- CVE-2026-92386
- SUSE Bug 1285018
Описание
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
Затронутые продукты
Ссылки
- CVE-2026-92387
- SUSE Bug 1285017
Описание
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Затронутые продукты
Ссылки
- CVE-2026-92388
- SUSE Bug 1285016
Описание
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
Затронутые продукты
Ссылки
- CVE-2026-92389
- SUSE Bug 1285015
Описание
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.
Затронутые продукты
Ссылки
- CVE-2026-92390
- SUSE Bug 1285014
Описание
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.
Затронутые продукты
Ссылки
- CVE-2026-92391
- SUSE Bug 1285013
Описание
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
Затронутые продукты
Ссылки
- CVE-2026-92392
- SUSE Bug 1285012
Описание
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket-generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.
Затронутые продукты
Ссылки
- CVE-2026-94265
- SUSE Bug 1285011
Описание
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
Затронутые продукты
Ссылки
- CVE-2026-94266
- SUSE Bug 1285010
Описание
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.
Затронутые продукты
Ссылки
- CVE-2026-9546
- SUSE Bug 1268419