# SUSE-SU-2026:5068-1: curl security update SUSE-SU-2026:5068-1, released November 7, 2026, fixes 31 CVEs in curl (version 8.22.0-150700.7.33.1). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-5068-1 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-11564, rated Critical) - CVEs: 31, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:5068-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [curl](https://patchblox.com/security/data/product/linux/curl.md) | sles 15.7 | 8.22.0-150700.7.33.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-11564](https://patchblox.com/security/data/cve/CVE-2026-11564.md) | Urgent | curl: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them match... | 9.1 | 0.0061 | | | [CVE-2026-92392](https://patchblox.com/security/data/cve/CVE-2026-92392.md) | High | HTTP/2 upload Use-After-Free | 8.1 | 0.0128 | | | [CVE-2026-86409](https://patchblox.com/security/data/cve/CVE-2026-86409.md) | High | stale SigV4 headers sent unintended | 8.1 | 0.0110 | | | [CVE-2026-11352](https://patchblox.com/security/data/cve/CVE-2026-11352.md) | High | curl: An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service a... | 7.5 | 0.0101 | | | [CVE-2026-11586](https://patchblox.com/security/data/cve/CVE-2026-11586.md) | High | curl: By default, curl automatically responds to WebSocket PING frames | 7.5 | 0.0086 | | | [CVE-2026-87864](https://patchblox.com/security/data/cve/CVE-2026-87864.md) | High | IMAP APPEND plus CRLF conversion command injection | 8.2 | 0.0083 | | | [CVE-2026-19931](https://patchblox.com/security/data/cve/CVE-2026-19931.md) | High | Negotiate ambient user conn reuse | 9.8 | 0.0075 | | | [CVE-2026-11856](https://patchblox.com/security/data/cve/CVE-2026-11856.md) | High | cross-origin Digest auth state leak | 9.8 | 0.0069 | | | [CVE-2026-86414](https://patchblox.com/security/data/cve/CVE-2026-86414.md) | High | leaking host credentials to HTTP proxy | 7.5 | 0.0068 | | | [CVE-2026-107929](https://patchblox.com/security/data/cve/CVE-2026-107929.md) | High | local interface connection reuse mixup | 8.1 | 0.0067 | | | [CVE-2026-9546](https://patchblox.com/security/data/cve/CVE-2026-9546.md) | High | curl: sending old referer (bsc#1268419). | 7.5 | 0.0065 | | | [CVE-2026-18924](https://patchblox.com/security/data/cve/CVE-2026-18924.md) | High | HTTP/2 server push UAF | 9.1 | 0.0058 | | | [CVE-2026-80255](https://patchblox.com/security/data/cve/CVE-2026-80255.md) | High | secure cookie attribute bypass with tab | 7.5 | 0.0048 | | | [CVE-2026-86411](https://patchblox.com/security/data/cve/CVE-2026-86411.md) | High | FTP connection reuse inherits client-certificate | 9.1 | 0.0043 | | | [CVE-2026-12064](https://patchblox.com/security/data/cve/CVE-2026-12064.md) | High | proto-default skips SSH verification | 7.5 | 0.0041 | | | [CVE-2026-8932](https://patchblox.com/security/data/cve/CVE-2026-8932.md) | High | incomplete mTLS config matching in conn reuse | 8.1 | 0.0040 | | | [CVE-2026-82209](https://patchblox.com/security/data/cve/CVE-2026-82209.md) | High | domain-scoped PSL domain cookie | 8.2 | 0.0037 | | | [CVE-2026-92391](https://patchblox.com/security/data/cve/CVE-2026-92391.md) | Routine | curl_mime_free stack overflow by recursion | 5.5 | 0.0117 | | | [CVE-2026-92387](https://patchblox.com/security/data/cve/CVE-2026-92387.md) | Routine | never-ending loop via server response omission | 5.3 | 0.0105 | | | [CVE-2026-87862](https://patchblox.com/security/data/cve/CVE-2026-87862.md) | Routine | HSTS cache import drops longer-lived child | 4.8 | 0.0100 | | | [CVE-2026-87863](https://patchblox.com/security/data/cve/CVE-2026-87863.md) | Routine | HSTS response erases persisted entries | 6.5 | 0.0083 | | | [CVE-2026-92386](https://patchblox.com/security/data/cve/CVE-2026-92386.md) | Routine | server-set cookie aborts cookie jar load | 3.7 | 0.0083 | | | [CVE-2026-86412](https://patchblox.com/security/data/cve/CVE-2026-86412.md) | Routine | server-set cookie erases cookie jar | 3.3 | 0.0083 | | | [CVE-2026-94265](https://patchblox.com/security/data/cve/CVE-2026-94265.md) | Routine | Authorization: Negotiate sent to foreign origin | 5.9 | 0.0078 | | | [CVE-2026-86410](https://patchblox.com/security/data/cve/CVE-2026-86410.md) | Routine | redirect to SFTP or SCP bypasses host verification | 5.9 | 0.0077 | | | [CVE-2026-86413](https://patchblox.com/security/data/cve/CVE-2026-86413.md) | Routine | Negotiate credentials sent to redirected origin | 5.9 | 0.0073 | | | [CVE-2026-92389](https://patchblox.com/security/data/cve/CVE-2026-92389.md) | Routine | TFTP direction confusion | 5.9 | 0.0072 | | | [CVE-2026-92388](https://patchblox.com/security/data/cve/CVE-2026-92388.md) | Routine | libcurl3-gnutls: When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leavin... | n/a | 0.0070 | | | [CVE-2026-87861](https://patchblox.com/security/data/cve/CVE-2026-87861.md) | Routine | cross-origin reuse of a Negotiate connection | 3.3 | 0.0068 | | | [CVE-2026-92390](https://patchblox.com/security/data/cve/CVE-2026-92390.md) | Routine | -J no-clobber guarantee bypassed with 103 early hints | 6.5 | 0.0059 | | | [CVE-2026-94266](https://patchblox.com/security/data/cve/CVE-2026-94266.md) | Routine | password leak in CURLINFO_EFFECTIVE_URL | 5.9 | 0.0056 | | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.