{"id":"CVE-2026-9545","aliases":["ALPINE-CVE-2026-9545","BELL-CVE-2026-9545","CURL-CVE-2026-9545","DEBIAN-CVE-2026-9545","EUVD-2026-41493","GHSA-6v72-wfcj-jv53","JLSEC-2026-1220","RHSA-2026:41240","ROOT-OS-ALPINE-320-CVE-2026-9545","ROOT-OS-ALPINE-321-CVE-2026-9545","ROOT-OS-ALPINE-322-CVE-2026-9545","ROOT-OS-ALPINE-323-CVE-2026-9545","ROOT-OS-DEBIAN-13-CVE-2026-9545","SUSE-SU-2026:22553-1","SUSE-SU-2026:22582-1","SUSE-SU-2026:22709-1","SUSE-SU-2026:22889-1","SUSE-SU-2026:2925-1","SUSE-SU-2026:2926-1","SUSE-SU-2026:3043-1","UBUNTU-CVE-2026-9545","openSUSE-SU-2026:11230-1","openSUSE-SU-2026:21272-1"],"status":"published","title":"exposing HTTP/3 early data","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00408,"percentile":0.35361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-06-24T08:00:00Z","modified":"2026-11-03T12:15:03Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.22.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.21.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.21.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.21.0+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"curl","fixed_in":["8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-curl","fixed_in":["8.14.1-r20077","8.14.1-r20078","8.14.1-r20079","8.14.1-r200710","8.14.1-r200711","8.14.1-r200712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-curl","fixed_in":["8.14.1-r20071","8.14.1-r20072","8.14.1-r20073","8.14.1-r30078","8.14.1-r20074","8.14.1-r20075","8.14.1-r20076","8.14.1-r20077","8.14.1-r30079","8.14.1-r300710","8.14.1-r300711","8.14.1-r300712"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.22","package":"rootio-curl","fixed_in":["8.14.1-r20072","8.14.1-r20071","8.14.1-r20073","8.14.1-r20074","8.14.1-r400710","8.14.1-r30075","8.14.1-r30076","8.14.1-r30077","8.14.1-r30078","8.14.1-r30079"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-curl","fixed_in":["8.14.1-2+deb13u7.aikido.24","8.14.1-2+deb13u7.aikido.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"curl","fixed_in":["8.18.0-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.22.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.21.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.1-2","8.14.1-2+deb13u1","8.14.1-2+deb13u2","8.14.1-2+deb13u2~bpo13+1","8.14.1-2+deb13u3","8.14.1-2+deb13u4","8.14.1-2+deb13u5","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0-1","8.21.0-1+exp1","8.21.0-2","8.21.0-2+exp1","8.21.0-2~bpo13+1","8.21.0~rc1-1+exp1","8.21.0~rc2-1","8.21.0~rc2-1+exp1","8.21.0~rc3-1","8.21.0~rc3-1+exp1","8.22.0-1","8.22.0-1+exp1","8.22.0~rc2-1","8.22.0~rc2-2","8.22.0~rc3-1","8.22.0~rc3-1+exp1","8.23.0~rc1-1","8.23.0~rc1-2","8.23.0~rc2-1","8.23.0~rc2-1+exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0~rc2-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0-1","8.16.0-1+exp1","8.16.0-1~bpo13+1","8.16.0-2","8.16.0-3","8.16.0-4","8.16.0-4~bpo13+1","8.16.0~rc1-1~exp1","8.16.0~rc2-1","8.16.0~rc2-2","8.16.0~rc3-1","8.17.0-1","8.17.0-2","8.17.0-3","8.17.0~rc1-1~exp1","8.17.0~rc2-1","8.17.0~rc3-1","8.18.0-1","8.18.0-1~bpo13+1","8.18.0-2","8.18.0~rc1-1+exp1","8.18.0~rc2-1","8.18.0~rc3-1","8.19.0-1","8.19.0-1+exp1","8.19.0-1~bpo13+1","8.19.0-2","8.19.0-3","8.19.0-3+exp1","8.19.0-3+exp2","8.19.0~rc1-1~exp1","8.19.0~rc2-1","8.19.0~rc2-2","8.19.0~rc3-1","8.20.0-1","8.20.0-1+exp","8.20.0-2","8.20.0-2+exp1","8.20.0-2~bpo13+1","8.20.0-3","8.20.0-4","8.20.0-5","8.20.0-5~bpo13+1","8.20.0~rc1-1+exp1","8.20.0~rc1-1+exp2","8.20.0~rc1-1+exp3","8.20.0~rc2-1","8.20.0~rc2-1+exp1","8.20.0~rc3-1","8.20.0~rc3-1+exp1","8.21.0~rc1-1+exp1"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.0+0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.0+0"},{"fixed":"8.21.0+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r20078"},{"fixed":"8.14.1-r20079"},{"fixed":"8.14.1-r200710"},{"fixed":"8.14.1-r200711"},{"fixed":"8.14.1-r200712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r20075"},{"fixed":"8.14.1-r20076"},{"fixed":"8.14.1-r20077"},{"fixed":"8.14.1-r30079"},{"fixed":"8.14.1-r300710"},{"fixed":"8.14.1-r300711"},{"fixed":"8.14.1-r300712"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.22","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-r20072"},{"fixed":"8.14.1-r20071"},{"fixed":"8.14.1-r20073"},{"fixed":"8.14.1-r20074"},{"fixed":"8.14.1-r400710"},{"fixed":"8.14.1-r30075"},{"fixed":"8.14.1-r30076"},{"fixed":"8.14.1-r30077"},{"fixed":"8.14.1-r30078"},{"fixed":"8.14.1-r30079"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u7.aikido.24"},{"fixed":"8.14.1-2+deb13u7.aikido.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_8.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150700.7.20.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.46.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.46.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.86.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.4"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1","8.14.1-2ubuntu1.1","8.14.1-2ubuntu1.2","8.14.1-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-1ubuntu2.2"}]}],"versions":["8.14.1-2ubuntu1","8.17.0-1ubuntu1","8.18.0-1ubuntu1","8.18.0-1ubuntu2","8.18.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.8.1"}]}],"bundled":10}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2026-9545.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2026-9545.html","tags":["Patch","Vendor Advisory","web","article"]},{"url":"https://hackerone.com/reports/3752888","tags":["exploit","Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-6v72-wfcj-jv53","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-9545","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-9545","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9545.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-9545","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41240","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58055","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9545","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41240.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9545","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-10536.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-10536.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751697","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","tags":["advisory"]},{"url":"https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","tags":["article"]},{"url":"https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622553-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268402","tags":["report"]},{"url":"https://bugzilla.suse.com/1268407","tags":["report"]},{"url":"https://bugzilla.suse.com/1268409","tags":["report"]},{"url":"https://bugzilla.suse.com/1268413","tags":["report"]},{"url":"https://bugzilla.suse.com/1268415","tags":["report"]},{"url":"https://bugzilla.suse.com/1268416","tags":["report"]},{"url":"https://bugzilla.suse.com/1268417","tags":["report"]},{"url":"https://bugzilla.suse.com/1268420","tags":["report"]},{"url":"https://bugzilla.suse.com/1268422","tags":["report"]},{"url":"https://bugzilla.suse.com/1268427","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622709-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622889-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262925-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262631","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4873","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263043-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9545","tags":["report"]},{"url":"https://curl.se/L7HzKXisfJ/CVE-2026-9545.md","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8487-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9546","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-9545","title":"exposing HTTP/3 early data","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T06:17:55.931Z","modified":"2026-09-15T06:03:31.804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-41493","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T06:17:55Z","modified":"2026-09-15T06:03:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-6v72-wfcj-jv53","title":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when...","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T09:31:27Z","modified":"2026-09-15T09:31:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:11:53.5286Z"}],"nvd":[{"id":"CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T07:16:25.807Z","modified":"2026-09-15T07:16:34.947Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"ALPINE-CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T07:16:25.807Z","modified":"2026-10-01T02:17:49.421802839Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-9545","status":"published","published":"2026-07-02T17:40:11.710932Z","modified":"2026-07-08T07:15:11.581604645Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"CVE-2026-9545","title":"exposing HTTP/3 early data","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-07-03T06:17:55.931Z","modified":"2026-10-28T11:09:56.055361273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.  When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.","status":"published","published":"2026-07-03T07:16:25.807Z","modified":"2026-10-01T03:03:56.254863748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"JLSEC-2026-1220","title":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when...","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-08-07T20:11:58.984Z","modified":"2026-08-07T20:28:39.393363311Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2026:41240","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-23T10:13:28Z","modified":"2026-10-20T10:08:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.","status":"published","published":"2026-06-24T14:00:00Z","modified":"2026-07-09T17:17:28.655893986Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"CURL-CVE-2026-9545","title":"exposing HTTP/3 early data","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.","status":"published","published":"2026-06-24T08:00:00Z","modified":"2026-10-25T01:04:34.878194086Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2026:11230-1","title":"curl-8.21.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.392224841Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21272-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:40Z","modified":"2026-07-11T18:24:39.683959322Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-9545","title":"CVE-2026-9545 in curl - Patched by Root","description":"Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:40:45Z","modified":"2026-09-29T10:15:07.423502281Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-9545","title":"CVE-2026-9545 in curl - Patched by Root","description":"Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T11:37:01Z","modified":"2026-11-03T12:15:03.347650986Z","updated_at":"2026-11-03T12:31:36.041963Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-9545","title":"CVE-2026-9545 in curl - Patched by Root","description":"Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:56:08Z","modified":"2026-10-19T07:15:05.256929762Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-9545","title":"CVE-2026-9545 in curl - Patched by Root","description":"Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-11T14:25:22Z","modified":"2026-10-09T13:00:05.460222819Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-9545","title":"CVE-2026-9545 in curl - Patched by Root","description":"Root has patched CVE-2026-9545 in the curl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:50:30Z","modified":"2026-11-03T11:15:04.775754685Z","updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"SUSE-SU-2026:22553-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:31Z","modified":"2026-07-14T18:24:37.508643741Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22582-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-08T13:46:31Z","modified":"2026-07-15T18:24:12.557773119Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22709-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-14T12:55:28Z","modified":"2026-07-23T18:24:15.490752267Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22889-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-21T16:53:33Z","modified":"2026-07-28T18:24:18.578169362Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2925-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-13T17:53:28Z","modified":"2026-07-15T10:00:04.814454459Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2926-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-13T17:55:13Z","modified":"2026-07-15T10:00:04.824336179Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3043-1","title":"Security update for curl","description":"This update for curl fixes the following issues\n\n- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).\n- CVE-2026-8458: wrong reuse for different services (bsc#1268407).\n- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).\n- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).\n- CVE-2026-9079: stale proxy password leak (bsc#1268415).\n- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).\n- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).\n- CVE-2026-9547: SSH improper host validation (bsc#1268420).\n- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).\n- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).\n","status":"published","published":"2026-07-15T11:51:36Z","modified":"2026-07-16T10:00:08.029752736Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}