SUSE-SU-2026:0911-1

Details

Description of the patch:

This update for curl fixes the following issues:

CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).

Affected Packages

libcurl4

SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

Fixed in:

8.14.1-150400.5.80.1

curl

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Micro 5.3

Fixed in:

8.14.1-150400.5.80.1

libcurl-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.14.1-150400.5.80.1

libcurl4-32bit

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.14.1-150400.5.80.1

References

ADVISORY

https://bugzilla.suse.com/1259362

ADVISORY

https://bugzilla.suse.com/1259363

ADVISORY

https://bugzilla.suse.com/1259364

ADVISORY

https://bugzilla.suse.com/1259365

ADVISORY