SUSE-SU-2026:4047-1

Dashboard / Vulnerabilities / SUSE-SU-2026:4047-1

SUSE-SU-2026:4047-1

Summary: Security update for curl

Details: This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633). - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440). - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412). - CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476). - CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479). - CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480). Changes for curl: - Call http_size() first to prioritize Transfer-Encoding: chunked over a zero Content-Length empty body check (bsc#1264971)

References: https://www.suse.com/support/update/announcement/2026/suse-su-20264047-1/, https://bugzilla.suse.com/1262633, https://bugzilla.suse.com/1263440, https://bugzilla.suse.com/1264971, https://bugzilla.suse.com/1268412, https://bugzilla.suse.com/1277476, https://bugzilla.suse.com/1277479, https://bugzilla.suse.com/1277480, https://www.suse.com/security/cve/CVE-2026-13608, https://www.suse.com/security/cve/CVE-2026-5773, https://www.suse.com/security/cve/CVE-2026-7168, https://www.suse.com/security/cve/CVE-2026-80229, https://www.suse.com/security/cve/CVE-2026-80230, https://www.suse.com/security/cve/CVE-2026-8926