curl security update

8.12.1-4.6 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix netrc password lookup for non-matching login CVE-2026-8926 8.12.1-4.5 - fix proxy auth not cleared properly on NULL CVE-2026-9079 - fix...

Oracle Linux 10 : curl (ELSA-2026-69125)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69125 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix...

CVE-2026-57229

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's...

EUVD-2026-83392

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's...

EUVD-2026-82029

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unwind state on addinterface failure When mt76wcidalloc fails, mt7915addinterface returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, a...

CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

OESA-2026-3774 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924...

CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

Security update for curl

This update for curl fixes the following issues: CVE-2026-5773: wrong reuse of SMB connection bsc1262633. CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. CVE-2026-8926: password leak with netrc and user in URL bsc1268412. CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause a...

SUSE-SU-2026:4047-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can...

SUSE-SU-2026:23638-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: OpenLDAP SASL authentication bypass...

OESA-2026-3678 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924...

OESA-2026-3676 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924...

OESA-2026-3675 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924...

CVE-2026-80898 netfs: clear PG_private_2 on copy-to-cache append failure

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

SUSE SLES12 Security Update : curl (SUSE-SU-2026:3814-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3814-1 advisory. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. -...

Security update for curl

This update for curl fixes the following issues: CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. CVE-2026-8458: wrong reuse for different services bsc1268407. CVE-2026-8924: traling dot domain super cookie bsc1268409...

SUSE-SU-2026:3814-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409...

curl: Unbound cross-peer HTTP Digest challenge state

Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...

EUVD-2026-65143

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...