SUSE SLES12 Security Update : curl (SUSE-SU-2026:4071-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4071-1 advisory. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass bsc1277476. - CVE-2026-80229: premature free...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

Critical Photon OS Security Update - PHSA-2026-5.0-92-1008

Updates of 'dotnet-runtime', 'curl', 'linux-esx', 'linux' packages of Photon OS have been released...

CLSA-2026-1789899988 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899690 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

CLSA-2026-1789899321 curl: Fix of 3 CVEs

CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection - CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and...

curl: CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL

A .netrc-sourced password, injected into the live URL handle at login time, survives an ordinary same-host relative Location: redirect and ends up verbatim in data-state.url, so it is exposed via CURLINFOEFFECTIVEURL, curl -w '%urleffective', and verbose -v output. Affected code...

curl: Windows filename sanitizer misses Unicode COM/LPT reserved device names

Hi all, I found a way for a server-selected Windows filename to bypass curl's reserved DOS device-name sanitizer. With curl -O -J, a Content-Disposition filename such as COM¹, COM², COM³, LPT¹, LPT², or LPT³ is left unchanged, even though Windows treats all six as reserved device names. Curl...

curl: CVE-2026-94265: Authorization: Negotiate sent to foreign origin

Hi all, I've discovered that curl can be made to send an "Authorization: Negotiate" header, carrying a freshly minted Kerberos ticket for the victim's ambient identity, to a host chosen by an HTTP redirect, without --location-trusted. All the attacker has to do is put arbitrary userinfo in the...

CLEANSTART-2026-CR32311 Security fix for CVE-2026-24515 applied in: apache-zookeeper 3.7.2-r4, cloudnative-pg-fips 1.24.4-r1, cloudnative-pg-fips 1.25.4-r1, curl 8.16.0-r0, curl 8.17.0-r0, curl 8.18.0-r0, druid-exporter-fips 0.10-r2, druid-exporter-fips 0.11-r3, druid-exporter-fips 0.8-r1, druid-exporter-fips 0.9-r1, expat 2.7.2-r0, minio-operator-fips 5.0.18-r6, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, tomcat11 11.0.18-r0

CVE-2026-24515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CU80287 Security fix for CVE-2014-0139 applied in: curl 7.36.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JW10713 Security fix for CVE-2014-0138 applied in: curl 7.36.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JM41545 Security fix for CVE-2016-5421 applied in: curl 7.50.1-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UL86016 Security fix for CVE-2016-5420 applied in: curl 7.50.1-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DO77426 Security fix for CVE-2016-5419 applied in: curl 7.50.1-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RA92052 Security fix for CVE-2016-7141 applied in: curl 7.50.2-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IQ08712 Security fix for CVE-2016-7167 applied in: curl 7.50.3-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DY91015 Security fix for CVE-2016-8625 applied in: curl 7.51.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RX12928 Security fix for CVE-2016-8624 applied in: curl 7.51.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-HY33416 Security fix for CVE-2016-8623 applied in: curl 7.51.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...