Linux · SUSE Linux Enterprise · Security advisory · November 7, 2026
SUSE-SU-2026:5068-1: curl security update
SUSE-SU-2026:5068-1, released November 7, 2026, fixes 31 CVEs in curl (version 8.22.0-150700.7.33.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
31
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0128
70th percentile
Priority of the 31 CVEs
Patch now 0
Urgent 1
High 16
Routine 14
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| curl | sles 15.7 | 8.22.0-150700.7.33.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-11564 | curl: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them match... | 9.1 | 0.0061 | None reported |
| High | CVE-2026-92392 | HTTP/2 upload Use-After-Free | 8.1 | 0.0128 | None reported |
| High | CVE-2026-86409 | stale SigV4 headers sent unintended | 8.1 | 0.0110 | None reported |
| High | CVE-2026-11352 | curl: An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service a... | 7.5 | 0.0101 | None reported |
| High | CVE-2026-11586 | curl: By default, curl automatically responds to WebSocket PING frames | 7.5 | 0.0086 | None reported |
| High | CVE-2026-87864 | IMAP APPEND plus CRLF conversion command injection | 8.2 | 0.0083 | None reported |
| High | CVE-2026-19931 | Negotiate ambient user conn reuse | 9.8 | 0.0075 | None reported |
| High | CVE-2026-11856 | cross-origin Digest auth state leak | 9.8 | 0.0069 | None reported |
| High | CVE-2026-86414 | leaking host credentials to HTTP proxy | 7.5 | 0.0068 | None reported |
| High | CVE-2026-107929 | local interface connection reuse mixup | 8.1 | 0.0067 | None reported |
| High | CVE-2026-9546 | curl: sending old referer (bsc#1268419). | 7.5 | 0.0065 | None reported |
| High | CVE-2026-18924 | HTTP/2 server push UAF | 9.1 | 0.0058 | None reported |
| High | CVE-2026-80255 | secure cookie attribute bypass with tab | 7.5 | 0.0048 | None reported |
| High | CVE-2026-86411 | FTP connection reuse inherits client-certificate | 9.1 | 0.0043 | None reported |
| High | CVE-2026-12064 | proto-default skips SSH verification | 7.5 | 0.0041 | None reported |
| High | CVE-2026-8932 | incomplete mTLS config matching in conn reuse | 8.1 | 0.0040 | None reported |
| High | CVE-2026-82209 | domain-scoped PSL domain cookie | 8.2 | 0.0037 | None reported |
| Routine | CVE-2026-92391 | curl_mime_free stack overflow by recursion | 5.5 | 0.0117 | None reported |
| Routine | CVE-2026-92387 | never-ending loop via server response omission | 5.3 | 0.0105 | None reported |
| Routine | CVE-2026-87862 | HSTS cache import drops longer-lived child | 4.8 | 0.0100 | None reported |
| Routine | CVE-2026-87863 | HSTS response erases persisted entries | 6.5 | 0.0083 | None reported |
| Routine | CVE-2026-92386 | server-set cookie aborts cookie jar load | 3.7 | 0.0083 | None reported |
| Routine | CVE-2026-86412 | server-set cookie erases cookie jar | 3.3 | 0.0083 | None reported |
| Routine | CVE-2026-94265 | Authorization: Negotiate sent to foreign origin | 5.9 | 0.0078 | None reported |
| Routine | CVE-2026-86410 | redirect to SFTP or SCP bypasses host verification | 5.9 | 0.0077 | None reported |
Showing 1 to 25 of 31
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.