CVE-2026-11856

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

• curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

• libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
• curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
• libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

• CVE-2026-11856: flush cached HTTP Digest auth state when the origin or credentials change on the same easy handle so a challenge computed for one origin or set of credentials is not reused for another

• CVE-2026-11856: flush cached HTTP Digest auth state when the origin or credentials change on the same easy handle so a challenge computed for one origin or set of credentials is not reused for another

• CVE-2026-11856: flush Digest auth state on origin or credential change to avoid leaking the Authorization header across origins on handle reuse

• SECURITY UPDATE: cross-origin Digest authentication state leak
  • debian/patches/CVE-2026-11856.patch: flush the cached Digest state in lib/http_digest.c, lib/urldata.h and lib/vauth/digest.c when the origin or credentials it was created for change on a reused handle, so an Authorization/Proxy-Authorization header is not sent to a different origin.
  • CVE-2026-11856

• SECURITY UPDATE: cross-origin Digest authentication state leak
  • debian/patches/CVE-2026-11856.patch: flush the cached Digest state in lib/http_digest.c, lib/urldata.h and lib/curl_sasl.c when the origin or credentials it was created for change on a reused handle, so an Authorization/Proxy-Authorization header is not sent to a different origin.
  • CVE-2026-11856

• CVE-2026-11856: flush Digest auth state on origin or credential change to avoid leaking the Authorization header across origins on handle reuse

• CVE-2026-11856: flush Digest auth state on origin or credential change to avoid leaking the Authorization header across origins on handle reuse

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the curl package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-11856 in the rootio-curl package for Root:Ubuntu:24.04. Multiple fixed versions available.

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated curl to version 8.22.0. (jsc#PED-16984)

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated to version 8.22.0. (jsc#PED-16984)

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).

It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information.