CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.(CVE-2026-11856)

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.(CVE-2026-13608)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924)

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931)

When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230)

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than when the connection was created.(CVE-2026-80231)

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).(CVE-2026-82209)

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

• SECURITY UPDATE: use-after-free in HTTP/2 server push transfers on shared handles
  • debian/patches/CVE-2026-18924.patch: make the duplicated handle created for a server push stream inherit the share of its parent handle in lib/http2.c
  • CVE-2026-18924

• SECURITY UPDATE: use-after-free when an HTTP/2 server push transfer is cleaned up while the parent handle uses a shared connection cache
  • debian/patches/CVE-2026-18924.patch: use-after-free when an HTTP/2 server push transfer is cleaned up while the parent handle uses a shared connection cache
  • CVE-2026-18924

• CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection
• CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected
• CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix

• CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection
• CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected
• CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix

• CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection
• CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected
• CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix

• SECURITY UPDATE: HTTP/2 server push use-after-free
  • debian/patches/CVE-2026-18924.patch: make a pushed transfer inherit the parent handle's share in lib/http2.c, so a connection held by a share cannot be freed while the pushed transfer still uses it.
  • CVE-2026-18924
• SECURITY UPDATE: public key pinning bypassed when no server certificate
  • debian/patches/CVE-2026-80230.patch: in lib/vtls/openssl.c, treat a missing server certificate as acceptable only when no pinned public key is configured, so pinning is still enforced with peer and host verification disabled.
  • CVE-2026-80230
• SECURITY UPDATE: cookie for an exact PSL domain kept wildcard scope
  • debian/patches/CVE-2026-82209.patch: in lib/cookie.c, clear the tailmatch flag when a cookie's Domain attribute is itself a public suffix, so it becomes host-only instead of being sent to sibling subdomains.
  • CVE-2026-82209

• CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection
• CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected
• CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix
• remove upstream test1701, which performs an HTTP/2 Upgrade on an HTTP/1.1 POST; nghttp2 1.43 no longer supports Upgrade requests carrying a body, so the test fails against the nghttpx in the build root

• CVE-2026-18924: use-after-free in the cleanup of HTTP/2 server push transfers, because a pushed transfer did not inherit the parent handle's share and could therefore outlive a shared connection
• CVE-2026-80230: public key pinning was not enforced when the server presented no certificate and both peer and host verification were disabled, so an unauthenticated connection succeeded where it should have been rejected
• CVE-2026-82209: a cookie whose Domain attribute exactly matched a public suffix was stored with wildcard domain scope instead of being coerced to host-only, so it was sent to arbitrary sibling subdomains under that public suffix
• remove upstream test1701, which performs an HTTP/2 Upgrade on an HTTP/1.1 POST; nghttp2 1.43 no longer supports Upgrade requests carrying a body, so the test fails against the nghttpx in the build root

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie

These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-18924 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-18924 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-18924 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Root has patched CVE-2026-18924 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-18924 in the curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-18924 in the curl package for Root:Debian:13. Multiple fixed versions available.

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated curl to version 8.22.0. (jsc#PED-16984)

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated to version 8.22.0. (jsc#PED-16984)

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate verification was disabled in certain circumstances. A remote attacker could possibly use this issue to bypass pinning checks and cause curl to accept connections that should have been rejected. (CVE-2026-80230)

Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)

Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)