OPENSUSE-SU-2026:12150-1
Vulnerability from csaf_opensuse - Published: 2026-10-16 00:00 - Updated: 2026-10-21 11:52Summary
curl-8.23.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: curl-8.23.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12150
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
36 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
7.5 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
7.4 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
6.4 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
4 (Medium)
Affected products
Recommended
36 products, the same list as for
CVE-2026-107928
Threats
Impact
moderate
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "curl-8.23.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the curl-8.23.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-12150",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12150-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-107928 page",
"url": "https://www.suse.com/security/cve/CVE-2026-107928/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-107929 page",
"url": "https://www.suse.com/security/cve/CVE-2026-107929/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86409 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86409/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86410 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86410/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86411 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86411/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86412 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86412/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86413 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86413/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-86414 page",
"url": "https://www.suse.com/security/cve/CVE-2026-86414/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87861 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87861/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87862 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87862/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87863 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87863/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87864 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87864/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87865 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87865/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-87866 page",
"url": "https://www.suse.com/security/cve/CVE-2026-87866/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92386 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92386/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92387 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92387/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92388 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92388/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92389 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92389/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92390 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92390/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92391 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92391/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-92392 page",
"url": "https://www.suse.com/security/cve/CVE-2026-92392/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-94265 page",
"url": "https://www.suse.com/security/cve/CVE-2026-94265/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-94266 page",
"url": "https://www.suse.com/security/cve/CVE-2026-94266/"
}
],
"title": "curl-8.23.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-10-21T11:52:45Z",
"generator": {
"date": "2026-10-16T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:12150-1",
"initial_release_date": "2026-10-16T00:00:00Z",
"revision_history": [
{
"date": "2026-10-16T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-17T09:17:45Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-10-21T11:52:45Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-1.1.aarch64",
"product": {
"name": "curl-0:8.23.0-1.1.aarch64",
"product_id": "curl-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-0:8.23.0-1.1.aarch64",
"product": {
"name": "curl-fish-completion-0:8.23.0-1.1.aarch64",
"product_id": "curl-fish-completion-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-0:8.23.0-1.1.aarch64",
"product": {
"name": "curl-zsh-completion-0:8.23.0-1.1.aarch64",
"product_id": "curl-zsh-completion-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-0:8.23.0-1.1.aarch64",
"product_id": "libcurl-devel-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"product_id": "libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"product_id": "libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-0:8.23.0-1.1.aarch64",
"product": {
"name": "libcurl4-0:8.23.0-1.1.aarch64",
"product_id": "libcurl4-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-0:8.23.0-1.1.aarch64",
"product": {
"name": "libcurl4-32bit-0:8.23.0-1.1.aarch64",
"product_id": "libcurl4-32bit-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.23.0-1.1?arch=aarch64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-0:8.23.0-1.1.aarch64",
"product": {
"name": "wcurl-0:8.23.0-1.1.aarch64",
"product_id": "wcurl-0:8.23.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.23.0-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-1.1.ppc64le",
"product": {
"name": "curl-0:8.23.0-1.1.ppc64le",
"product_id": "curl-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-0:8.23.0-1.1.ppc64le",
"product": {
"name": "curl-fish-completion-0:8.23.0-1.1.ppc64le",
"product_id": "curl-fish-completion-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"product": {
"name": "curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"product_id": "curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-0:8.23.0-1.1.ppc64le",
"product_id": "libcurl-devel-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"product_id": "libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"product_id": "libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-0:8.23.0-1.1.ppc64le",
"product": {
"name": "libcurl4-0:8.23.0-1.1.ppc64le",
"product_id": "libcurl4-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"product": {
"name": "libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"product_id": "libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.23.0-1.1?arch=ppc64le\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-0:8.23.0-1.1.ppc64le",
"product": {
"name": "wcurl-0:8.23.0-1.1.ppc64le",
"product_id": "wcurl-0:8.23.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.23.0-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-1.1.s390x",
"product": {
"name": "curl-0:8.23.0-1.1.s390x",
"product_id": "curl-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-0:8.23.0-1.1.s390x",
"product": {
"name": "curl-fish-completion-0:8.23.0-1.1.s390x",
"product_id": "curl-fish-completion-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-0:8.23.0-1.1.s390x",
"product": {
"name": "curl-zsh-completion-0:8.23.0-1.1.s390x",
"product_id": "curl-zsh-completion-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-1.1.s390x",
"product": {
"name": "libcurl-devel-0:8.23.0-1.1.s390x",
"product_id": "libcurl-devel-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"product": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"product_id": "libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-0:8.23.0-1.1.s390x",
"product": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.s390x",
"product_id": "libcurl-devel-doc-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-0:8.23.0-1.1.s390x",
"product": {
"name": "libcurl4-0:8.23.0-1.1.s390x",
"product_id": "libcurl4-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-0:8.23.0-1.1.s390x",
"product": {
"name": "libcurl4-32bit-0:8.23.0-1.1.s390x",
"product_id": "libcurl4-32bit-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.23.0-1.1?arch=s390x\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-0:8.23.0-1.1.s390x",
"product": {
"name": "wcurl-0:8.23.0-1.1.s390x",
"product_id": "wcurl-0:8.23.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.23.0-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-0:8.23.0-1.1.x86_64",
"product": {
"name": "curl-0:8.23.0-1.1.x86_64",
"product_id": "curl-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-fish-completion-0:8.23.0-1.1.x86_64",
"product": {
"name": "curl-fish-completion-0:8.23.0-1.1.x86_64",
"product_id": "curl-fish-completion-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-fish-completion@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-0:8.23.0-1.1.x86_64",
"product": {
"name": "curl-zsh-completion-0:8.23.0-1.1.x86_64",
"product_id": "curl-zsh-completion-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/curl-zsh-completion@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-0:8.23.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-0:8.23.0-1.1.x86_64",
"product_id": "libcurl-devel-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"product_id": "libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-32bit@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"product_id": "libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl-devel-doc@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-0:8.23.0-1.1.x86_64",
"product": {
"name": "libcurl4-0:8.23.0-1.1.x86_64",
"product_id": "libcurl4-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-0:8.23.0-1.1.x86_64",
"product": {
"name": "libcurl4-32bit-0:8.23.0-1.1.x86_64",
"product_id": "libcurl4-32bit-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:haxx:curl:8.23.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libcurl4-32bit@8.23.0-1.1?arch=x86_64\u0026upstream=curl-0:8.23.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "wcurl-0:8.23.0-1.1.x86_64",
"product": {
"name": "wcurl-0:8.23.0-1.1.x86_64",
"product_id": "wcurl-0:8.23.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/wcurl@8.23.0-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64"
},
"product_reference": "curl-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le"
},
"product_reference": "curl-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x"
},
"product_reference": "curl-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64"
},
"product_reference": "curl-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64"
},
"product_reference": "curl-fish-completion-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le"
},
"product_reference": "curl-fish-completion-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x"
},
"product_reference": "curl-fish-completion-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64"
},
"product_reference": "curl-fish-completion-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64"
},
"product_reference": "curl-zsh-completion-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le"
},
"product_reference": "curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x"
},
"product_reference": "curl-zsh-completion-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64"
},
"product_reference": "curl-zsh-completion-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x"
},
"product_reference": "libcurl-devel-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x"
},
"product_reference": "libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x"
},
"product_reference": "libcurl-devel-doc-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64"
},
"product_reference": "libcurl4-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le"
},
"product_reference": "libcurl4-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x"
},
"product_reference": "libcurl4-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64"
},
"product_reference": "libcurl4-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64"
},
"product_reference": "libcurl4-32bit-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le"
},
"product_reference": "libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x"
},
"product_reference": "libcurl4-32bit-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64"
},
"product_reference": "libcurl4-32bit-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-0:8.23.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64"
},
"product_reference": "wcurl-0:8.23.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-0:8.23.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le"
},
"product_reference": "wcurl-0:8.23.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-0:8.23.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x"
},
"product_reference": "wcurl-0:8.23.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-0:8.23.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
},
"product_reference": "wcurl-0:8.23.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-107928",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-107928"
}
],
"notes": [
{
"category": "general",
"text": "When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-107928",
"url": "https://www.suse.com/security/cve/CVE-2026-107928"
},
{
"category": "external",
"summary": "SUSE Bug 1285009 for CVE-2026-107928",
"url": "https://bugzilla.suse.com/1285009"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-107928"
},
{
"cve": "CVE-2026-107929",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-107929"
}
],
"notes": [
{
"category": "general",
"text": "When `CURLOPT_INTERFACE` (or the command line tool\u0027s `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer\u0027s source address",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-107929",
"url": "https://www.suse.com/security/cve/CVE-2026-107929"
},
{
"category": "external",
"summary": "SUSE Bug 1285008 for CVE-2026-107929",
"url": "https://bugzilla.suse.com/1285008"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-107929"
},
{
"cve": "CVE-2026-86409",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86409"
}
],
"notes": [
{
"category": "general",
"text": "Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86409",
"url": "https://www.suse.com/security/cve/CVE-2026-86409"
},
{
"category": "external",
"summary": "SUSE Bug 1285031 for CVE-2026-86409",
"url": "https://bugzilla.suse.com/1285031"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-86409"
},
{
"cve": "CVE-2026-86410",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86410"
}
],
"notes": [
{
"category": "general",
"text": "A flaw in the curl command line tool\u0027s logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86410",
"url": "https://www.suse.com/security/cve/CVE-2026-86410"
},
{
"category": "external",
"summary": "SUSE Bug 1285030 for CVE-2026-86410",
"url": "https://bugzilla.suse.com/1285030"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-86410"
},
{
"cve": "CVE-2026-86411",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86411"
}
],
"notes": [
{
"category": "general",
"text": "An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle\u0027s certificate identity.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86411",
"url": "https://www.suse.com/security/cve/CVE-2026-86411"
},
{
"category": "external",
"summary": "SUSE Bug 1285029 for CVE-2026-86411",
"url": "https://bugzilla.suse.com/1285029"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-86411"
},
{
"cve": "CVE-2026-86412",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86412"
}
],
"notes": [
{
"category": "general",
"text": "A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86412",
"url": "https://www.suse.com/security/cve/CVE-2026-86412"
},
{
"category": "external",
"summary": "SUSE Bug 1285028 for CVE-2026-86412",
"url": "https://bugzilla.suse.com/1285028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-86412"
},
{
"cve": "CVE-2026-86413",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86413"
}
],
"notes": [
{
"category": "general",
"text": "When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86413",
"url": "https://www.suse.com/security/cve/CVE-2026-86413"
},
{
"category": "external",
"summary": "SUSE Bug 1285027 for CVE-2026-86413",
"url": "https://bugzilla.suse.com/1285027"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-86413"
},
{
"cve": "CVE-2026-86414",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-86414"
}
],
"notes": [
{
"category": "general",
"text": "An HTTP proxy can trick libcurl into sending the origin\u0027s credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-86414",
"url": "https://www.suse.com/security/cve/CVE-2026-86414"
},
{
"category": "external",
"summary": "SUSE Bug 1285026 for CVE-2026-86414",
"url": "https://bugzilla.suse.com/1285026"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-86414"
},
{
"cve": "CVE-2026-87861",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87861"
}
],
"notes": [
{
"category": "general",
"text": "When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request\u0027s intended credentials unused.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87861",
"url": "https://www.suse.com/security/cve/CVE-2026-87861"
},
{
"category": "external",
"summary": "SUSE Bug 1285024 for CVE-2026-87861",
"url": "https://bugzilla.suse.com/1285024"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-87861"
},
{
"cve": "CVE-2026-87862",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87862"
}
],
"notes": [
{
"category": "general",
"text": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild\u0027s valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87862",
"url": "https://www.suse.com/security/cve/CVE-2026-87862"
},
{
"category": "external",
"summary": "SUSE Bug 1285023 for CVE-2026-87862",
"url": "https://bugzilla.suse.com/1285023"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-87862"
},
{
"cve": "CVE-2026-87863",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87863"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87863",
"url": "https://www.suse.com/security/cve/CVE-2026-87863"
},
{
"category": "external",
"summary": "SUSE Bug 1285022 for CVE-2026-87863",
"url": "https://bugzilla.suse.com/1285022"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-87863"
},
{
"cve": "CVE-2026-87864",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87864"
}
],
"notes": [
{
"category": "general",
"text": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87864",
"url": "https://www.suse.com/security/cve/CVE-2026-87864"
},
{
"category": "external",
"summary": "SUSE Bug 1285021 for CVE-2026-87864",
"url": "https://bugzilla.suse.com/1285021"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-87864"
},
{
"cve": "CVE-2026-87865",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87865"
}
],
"notes": [
{
"category": "general",
"text": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87865",
"url": "https://www.suse.com/security/cve/CVE-2026-87865"
},
{
"category": "external",
"summary": "SUSE Bug 1285020 for CVE-2026-87865",
"url": "https://bugzilla.suse.com/1285020"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-87865"
},
{
"cve": "CVE-2026-87866",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-87866"
}
],
"notes": [
{
"category": "general",
"text": "When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl\u0027s subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-87866",
"url": "https://www.suse.com/security/cve/CVE-2026-87866"
},
{
"category": "external",
"summary": "SUSE Bug 1285019 for CVE-2026-87866",
"url": "https://bugzilla.suse.com/1285019"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-87866"
},
{
"cve": "CVE-2026-92386",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92386"
}
],
"notes": [
{
"category": "general",
"text": "When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92386",
"url": "https://www.suse.com/security/cve/CVE-2026-92386"
},
{
"category": "external",
"summary": "SUSE Bug 1285018 for CVE-2026-92386",
"url": "https://bugzilla.suse.com/1285018"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92386"
},
{
"cve": "CVE-2026-92387",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92387"
}
],
"notes": [
{
"category": "general",
"text": "By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92387",
"url": "https://www.suse.com/security/cve/CVE-2026-92387"
},
{
"category": "external",
"summary": "SUSE Bug 1285017 for CVE-2026-92387",
"url": "https://bugzilla.suse.com/1285017"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92387"
},
{
"cve": "CVE-2026-92388",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92388"
}
],
"notes": [
{
"category": "general",
"text": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92388",
"url": "https://www.suse.com/security/cve/CVE-2026-92388"
},
{
"category": "external",
"summary": "SUSE Bug 1285016 for CVE-2026-92388",
"url": "https://bugzilla.suse.com/1285016"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92388"
},
{
"cve": "CVE-2026-92389",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92389"
}
],
"notes": [
{
"category": "general",
"text": "libcurl\u0027s TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle\u0027s persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92389",
"url": "https://www.suse.com/security/cve/CVE-2026-92389"
},
{
"category": "external",
"summary": "SUSE Bug 1285015 for CVE-2026-92389",
"url": "https://bugzilla.suse.com/1285015"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92389"
},
{
"cve": "CVE-2026-92390",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92390"
}
],
"notes": [
{
"category": "general",
"text": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92390",
"url": "https://www.suse.com/security/cve/CVE-2026-92390"
},
{
"category": "external",
"summary": "SUSE Bug 1285014 for CVE-2026-92390",
"url": "https://bugzilla.suse.com/1285014"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92390"
},
{
"cve": "CVE-2026-92391",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92391"
}
],
"notes": [
{
"category": "general",
"text": "A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92391",
"url": "https://www.suse.com/security/cve/CVE-2026-92391"
},
{
"category": "external",
"summary": "SUSE Bug 1285013 for CVE-2026-92391",
"url": "https://bugzilla.suse.com/1285013"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-92391"
},
{
"cve": "CVE-2026-92392",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-92392"
}
],
"notes": [
{
"category": "general",
"text": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-92392",
"url": "https://www.suse.com/security/cve/CVE-2026-92392"
},
{
"category": "external",
"summary": "SUSE Bug 1285012 for CVE-2026-92392",
"url": "https://bugzilla.suse.com/1285012"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-92392"
},
{
"cve": "CVE-2026-94265",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-94265"
}
],
"notes": [
{
"category": "general",
"text": "When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host\u0027s HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket-generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-94265",
"url": "https://www.suse.com/security/cve/CVE-2026-94265"
},
{
"category": "external",
"summary": "SUSE Bug 1285011 for CVE-2026-94265",
"url": "https://bugzilla.suse.com/1285011"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-94265"
},
{
"cve": "CVE-2026-94266",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-94266"
}
],
"notes": [
{
"category": "general",
"text": "libcurl could accidentally return a URL for `curl_easy_getinfo()`\u0027s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-94266",
"url": "https://www.suse.com/security/cve/CVE-2026-94266"
},
{
"category": "external",
"summary": "SUSE Bug 1285010 for CVE-2026-94266",
"url": "https://bugzilla.suse.com/1285010"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-0:8.23.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-0:8.23.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-94266"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.