CVE-2026-8932

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927: env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)', 'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)', 'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH verification (LOW)', '--\n\n / daniel.haxx.se ||'

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

• curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

• libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)

• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)

• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)

• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to Rocky Linux 8 libcurl (JIRA:Rocky Linux-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
• curl: curl: Information disclosure via incorrect .netrc password lookup (CVE-2026-8926)
• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
• libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials (CVE-2026-9079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
• curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
• curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
• curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
• curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927)

Bug Fix(es) and Enhancement(s):

• Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

• CVE-2026-8927: flush the proxy Digest authentication state when the proxy read from an environment variable differs from the one that state was established for, so a Proxy-Authorization header computed for one proxy is not sent to a different proxy on a reused handle
• CVE-2026-8932: compare the client certificate type and the private key, its type, password and blob when matching a connection for reuse and when matching a cached TLS session, so a transfer cannot silently inherit another handle's authenticated client identity

• CVE-2026-8927: flush the proxy Digest authentication state when the proxy read from an environment variable differs from the one that state was established for, so a Proxy-Authorization header computed for one proxy is not sent to a different proxy on a reused handle
• CVE-2026-8932: compare the client certificate type and the private key, its type, password and blob when matching a connection for reuse and when matching a cached TLS session, so a transfer cannot silently inherit another handle's authenticated client identity

• SECURITY UPDATE: connection reuse ignored client-certificate config
  • debian/patches/CVE-2026-8932.patch: promote the client certificate type, private key, key type and key password into ssl_primary_config so the connection-reuse and session-cache match checks cover the full mTLS client credential, in lib/urldata.h, lib/url.c, lib/vtls/vtls.c and the TLS/ldap/ssh consumers, so a reused connection cannot inherit a different client credential.
  • CVE-2026-8932

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• CVE-2026-8927: url: detect proxy changes read from environment to flush proxy Digest state
• CVE-2026-8932: tls: fix incomplete mTLS config in connection reuse and session cache

• CVE-2026-8932: authentication bypass through connection reuse, where the client certificate type, private key, key type and key password were not part of the SSL configuration compared by Curl_ssl_config_matches(), so an easy handle could inherit another handle's authenticated mTLS connection

• CVE-2026-8932: authentication bypass through connection reuse, where the client certificate type, private key, key type and key password were not part of the SSL configuration compared by Curl_ssl_config_matches(), so an easy handle could inherit another handle's authenticated mTLS connection

• CVE-2026-8932: authentication bypass through connection reuse, where the client certificate type, private key, key type and key password were not part of the SSL configuration compared by Curl_ssl_config_matches(), so an easy handle could inherit another handle's authenticated mTLS connection

• SECURITY UPDATE: stale custom cookie host causes cookie leak
  • debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c.
  • CVE-2026-6276
• SECURITY UPDATE: wrong STARTTLS connection reuse
  • debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c.
  • CVE-2026-8286
• SECURITY UPDATE: env-set cross-proxy Digest auth state leak
  • debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h.
  • CVE-2026-8927
• SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache
  • debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c.
  • CVE-2026-8932
• SECURITY UPDATE: HTTP/2 push headers memory leak
  • debian/patches/CVE-2024-2398.patch: free the whole set of push headers on the array-growth failure path in lib/http2.c.
  • CVE-2024-2398

• SECURITY UPDATE: mTLS connection reuse with mismatched client key config
  • debian/patches/CVE-2026-8932.patch: promote cert_type, key, key_type and key_passwd into ssl_primary_config so connection reuse and the TLS session cache compare the full client credential set in lib/urldata.h, lib/url.c, lib/vtls/vtls.c and the TLS backends
  • debian/patches/CVE-2026-8932-tests.patch: add test3303 exercising conn-reuse matching on the mTLS key, cert_type, key_type and key_passwd fields.
  • CVE-2026-8932

• SECURITY UPDATE: connection reuse ignored client-certificate config
  • debian/patches/CVE-2026-8932.patch: include the client certificate type, private key, key type and key password in the connection-reuse and session-cache match checks in lib/urldata.h, lib/url.c and lib/vtls/vtls.c, so a reused connection cannot inherit a different mTLS client credential; also add the missing strequal.h include to lib/vtls/vtls.c so Curl_safecmp() and Curl_timestrcmp() are declared rather than reached through an implicit declaration.
  • CVE-2026-8932

• CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies
• CVE-2026-8932: fix incomplete mTLS config matching in connection reuse

• CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies
• CVE-2026-8932: fix incomplete mTLS config matching in connection reuse

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-8932 in the curl package for Root:Debian:13. Multiple fixed versions available.

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated curl to version 8.22.0. (jsc#PED-16984)

This update for curl fixes the following issues:

• CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
• CVE-2026-9546: sending old referer (bsc#1268419).
• CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
• CVE-2026-11564: Native CA trust persist (bsc#1268424).
• CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
• CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
• CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
• CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
• CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
• CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
• CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
• CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
• CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
• CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
• CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
• CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
• CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
• CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
• CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
• CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
• CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
• CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
• CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
• CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
• CVE-2026-92389: TFTP direction confusion (bsc#1285015).
• CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
• CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
• CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
• CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
• CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
• CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

• Updated to version 8.22.0. (jsc#PED-16984)