CVE-2026-8927

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536)

When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064)

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286)

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924)

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.(CVE-2026-8927)

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

• SECURITY UPDATE: libcurl could reuse a connection for a STARTTLS transfer despite a mismatched TLS configuration.
  • debian/patches/CVE-2026-8286.patch: add an SSL-config match check before reusing a connection for a clear-text protocol that requests TLS, in lib/url.c.
  • CVE-2026-8286
• SECURITY UPDATE: a trailing-dot cookie domain could bypass the Public Suffix List check and set a super-cookie.
  • debian/patches/CVE-2026-8924.patch: trim trailing dots from the domains before the PSL check in lib/cookie.c.
  • CVE-2026-8924
• SECURITY UPDATE: libcurl could send proxy Digest credentials to the wrong proxy when the proxy is selected from environment variables on a reused handle.
  • debian/patches/CVE-2026-8927.patch: clear the proxy Digest state when the environment proxy changes, in lib/url.c and lib/urldata.h.
  • CVE-2026-8927

• SECURITY UPDATE: env-set cross-proxy Digest auth state leak (libcurl)
  • debian/patches/CVE-2026-8927.patch: detect env-proxy changes and flush state.proxydigest to prevent stale Digest auth replay across handle reuses in lib/url.c, lib/urldata.h.
  • debian/patches/CVE-2026-8927-tests.patch: add test1647 exercising env-set cross-proxy Digest auth state leak.
  • CVE-2026-8927

• CVE-2026-8927: flush the proxy Digest authentication state when the proxy read from an environment variable differs from the one that state was established for, so a Proxy-Authorization header computed for one proxy is not sent to a different proxy on a reused handle
• CVE-2026-8932: compare the client certificate type and the private key, its type, password and blob when matching a connection for reuse and when matching a cached TLS session, so a transfer cannot silently inherit another handle's authenticated client identity

• CVE-2026-8927: flush the proxy Digest authentication state when the proxy read from an environment variable differs from the one that state was established for, so a Proxy-Authorization header computed for one proxy is not sent to a different proxy on a reused handle
• CVE-2026-8932: compare the client certificate type and the private key, its type, password and blob when matching a connection for reuse and when matching a cached TLS session, so a transfer cannot silently inherit another handle's authenticated client identity

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• SECURITY UPDATE: stale custom cookie host causes cookie leak
  • debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c.
  • CVE-2026-6276
• SECURITY UPDATE: wrong STARTTLS connection reuse
  • debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c.
  • CVE-2026-8286
• SECURITY UPDATE: env-set cross-proxy Digest auth state leak
  • debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h.
  • CVE-2026-8927
• SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache
  • debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c.
  • CVE-2026-8932
• SECURITY UPDATE: HTTP/2 push headers memory leak
  • debian/patches/CVE-2024-2398.patch: free the whole set of push headers on the array-growth failure path in lib/http2.c.
  • CVE-2024-2398

• CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies
• CVE-2026-8932: fix incomplete mTLS config matching in connection reuse

• CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies
• CVE-2026-8932: fix incomplete mTLS config matching in connection reuse

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues

• CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
• CVE-2026-8458: wrong reuse for different services (bsc#1268407).
• CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
• CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
• CVE-2026-9079: stale proxy password leak (bsc#1268415).
• CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
• CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
• CVE-2026-9547: SSH improper host validation (bsc#1268420).
• CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-8927 in the curl package for Root:Debian:13. Multiple fixed versions available.

This update for curl fixes the following issues

• CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
• CVE-2026-8458: wrong reuse for different services (bsc#1268407).
• CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
• CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
• CVE-2026-9079: stale proxy password leak (bsc#1268415).
• CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
• CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
• CVE-2026-9547: SSH improper host validation (bsc#1268420).
• CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

This update for curl fixes the following issues

• CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
• CVE-2026-8458: wrong reuse for different services (bsc#1268407).
• CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
• CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
• CVE-2026-9079: stale proxy password leak (bsc#1268415).
• CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
• CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
• CVE-2026-9547: SSH improper host validation (bsc#1268420).
• CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

This update for curl fixes the following issues

• CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
• CVE-2026-8458: wrong reuse for different services (bsc#1268407).
• CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
• CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
• CVE-2026-9079: stale proxy password leak (bsc#1268415).
• CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
• CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
• CVE-2026-9547: SSH improper host validation (bsc#1268420).
• CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

This update for curl fixes the following issues

• CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
• CVE-2026-8458: wrong reuse for different services (bsc#1268407).
• CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
• CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
• CVE-2026-9079: stale proxy password leak (bsc#1268415).
• CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
• CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
• CVE-2026-9547: SSH improper host validation (bsc#1268420).
• CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).