curl-8.18.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2026:10017-1 Final 1 1 2026-01-08T00:00:00Z current 2026-01-08T00:00:00Z 2026-01-08T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z curl-8.18.0-1.1 on GA media These are all security issues fixed in the curl-8.18.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2026-10017 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-14017/ SUSE CVE CVE-2025-14017 page https://www.suse.com/security/cve/CVE-2025-14524/ SUSE CVE CVE-2025-14524 page https://www.suse.com/security/cve/CVE-2025-14819/ SUSE CVE CVE-2025-14819 page https://www.suse.com/security/cve/CVE-2025-15079/ SUSE CVE CVE-2025-15079 page https://www.suse.com/security/cve/CVE-2025-15224/ SUSE CVE CVE-2025-15224 page openSUSE Tumbleweed curl-8.18.0-1.1 curl-fish-completion-8.18.0-1.1 curl-zsh-completion-8.18.0-1.1 libcurl-devel-8.18.0-1.1 libcurl-devel-32bit-8.18.0-1.1 libcurl-devel-doc-8.18.0-1.1 libcurl4-8.18.0-1.1 libcurl4-32bit-8.18.0-1.1 wcurl-8.18.0-1.1 curl-8.18.0-1.1 as a component of openSUSE Tumbleweed curl-fish-completion-8.18.0-1.1 as a component of openSUSE Tumbleweed curl-zsh-completion-8.18.0-1.1 as a component of openSUSE Tumbleweed libcurl-devel-8.18.0-1.1 as a component of openSUSE Tumbleweed libcurl-devel-32bit-8.18.0-1.1 as a component of openSUSE Tumbleweed libcurl-devel-doc-8.18.0-1.1 as a component of openSUSE Tumbleweed libcurl4-8.18.0-1.1 as a component of openSUSE Tumbleweed libcurl4-32bit-8.18.0-1.1 as a component of openSUSE Tumbleweed wcurl-8.18.0-1.1 as a component of openSUSE Tumbleweed When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. CVE-2025-14017 openSUSE Tumbleweed:curl-8.18.0-1.1 openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1 openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-8.18.0-1.1 openSUSE Tumbleweed:wcurl-8.18.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-14017.html CVE-2025-14017 https://bugzilla.suse.com/1256105 SUSE Bug 1256105 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. CVE-2025-14524 openSUSE Tumbleweed:curl-8.18.0-1.1 openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1 openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-8.18.0-1.1 openSUSE Tumbleweed:wcurl-8.18.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-14524.html CVE-2025-14524 https://bugzilla.suse.com/1255731 SUSE Bug 1255731 When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. CVE-2025-14819 openSUSE Tumbleweed:curl-8.18.0-1.1 openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1 openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-8.18.0-1.1 openSUSE Tumbleweed:wcurl-8.18.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-14819.html CVE-2025-14819 https://bugzilla.suse.com/1255732 SUSE Bug 1255732 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. CVE-2025-15079 openSUSE Tumbleweed:curl-8.18.0-1.1 openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1 openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-8.18.0-1.1 openSUSE Tumbleweed:wcurl-8.18.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-15079.html CVE-2025-15079 https://bugzilla.suse.com/1255733 SUSE Bug 1255733 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. CVE-2025-15224 openSUSE Tumbleweed:curl-8.18.0-1.1 openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1 openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1 openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1 openSUSE Tumbleweed:libcurl4-8.18.0-1.1 openSUSE Tumbleweed:wcurl-8.18.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-15224.html CVE-2025-15224 https://bugzilla.suse.com/1255734 SUSE Bug 1255734