SUSE · Security update for curl
Affects SUSE Product Security Team SUSESource GCVE Database
Mentioned vulnerabilities
Not known to be exploited · fixed in 8.5.0-2ubuntu10.15 : update SUSE Product Security Team SUSE when convenient.
Data as of 10/25/2026, 16:58:55 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8.5.0-2ubuntu10.15, 8.18.0-1ubuntu2.7
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wild: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu:Pro:14.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=esm-infra-legacy/trustyOther threats | Affected
| Fixed in– |
Ubuntu:Pro:16.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=esm-infra-legacy/xenialOther threats | Affected
| Fixed in– |
Ubuntu:Pro:18.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=esm-infra/bionicOther threats | Affected
| Fixed in– |
Ubuntu:Pro:20.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=esm-infra/focalOther threats | Affected
| Fixed in– |
Ubuntu:22.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=jammyOther threats | Affected
| Fixed in– |
Ubuntu:24.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=nobleOther threats | Affected
| Fixed in
|
Ubuntu:26.04:LTScurlpkg:deb/ubuntu/curl?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and should be applied to affected curl versions to remediate these vulnerabilities. Users should update to the fixed versions provided by their vendor. No additional mitigation steps are indicated by the vendor advisory.
Description
This security update for curl addresses multiple vulnerabilities including SMB connection reuse, cross-proxy Digest authentication state leak, password leak via netrc and user in URL, OpenLDAP SASL authentication bypass, and OpenSSL use-after-free and pinning bypass issues. These vulnerabilities could lead to unauthorized access or information disclosure. The update fixes these issues in affected versions of curl. No known exploits are reported in the wild. The severity is assessed as medium.
Impact
Exploitation of these vulnerabilities could result in unauthorized authentication bypass, information leakage including passwords, and potential memory corruption leading to denial of service or code execution. However, no known exploits are reported in the wild at this time. The impact is considered medium severity due to the nature of the vulnerabilities and their potential consequences.
Weaknesses
- CWE-923Improper Restriction of Communication Channel to Intended Endpoints (opens in a new tab)
Class weakness
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
- CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-488Exposure of Data Element to Wrong Session (opens in a new tab)
Base weakness
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
References
- ubuntu.com/security/CVE-2026-13608 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-13608 (opens in a new tab)
- curl.se/docs/CVE-2026-13608.html (opens in a new tab)
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21774-1.json (opens in a new tab)
- bugzilla.suse.com/1262633 (opens in a new tab)
- bugzilla.suse.com/1263440 (opens in a new tab)
- bugzilla.suse.com/1268412 (opens in a new tab)
- bugzilla.suse.com/1277476 (opens in a new tab)
- bugzilla.suse.com/1277479 (opens in a new tab)
- bugzilla.suse.com/1277480 (opens in a new tab)
- suse.com/security/cve/CVE-2026-13608/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-5773/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-7168/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-80229/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-80230/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-8926/ (opens in a new tab)
- access.redhat.com/errata/RHSA-2026:63514 (opens in a new tab)
- images.redhat.com (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-19931 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-13608 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-18924 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63514.json (opens in a new tab)
- github.com/curl/curl/commit/ea71c3b6b60e563651ea8596a9 (opens in a new tab)
- ubuntu.com/security/notices/USN-8820-1 (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23638-1.json (opens in a new tab)
- suse.com/support/update/announcement/2026/suse-su-202623638-1/ (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-September/029065.html (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23498-1.json (opens in a new tab)
- suse.com/support/update/announcement/2026/suse-su-202623498-1/ (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-September/028995.html (opens in a new tab)