Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0508-1 Final 1 1 2026-02-13T14:50:33Z current 2026-02-13T14:50:33Z 2026-02-13T14:50:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: - CVE-2025-14017: Fixed broken TLS options for threaded LDAPS (bsc#1256105). - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle-micro/base-5.5:latest-2026-508,Container suse/sle-micro/kvm-5.5:latest-2026-508,SUSE-2026-508,SUSE-SLE-Micro-5.3-2026-508,SUSE-SLE-Micro-5.4-2026-508,SUSE-SLE-Micro-5.5-2026-508 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ Link for SUSE-SU-2026:0508-1 https://lists.suse.com/pipermail/sle-security-updates/2026-February/024240.html E-Mail link for SUSE-SU-2026:0508-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1255731 SUSE Bug 1255731 https://bugzilla.suse.com/1255732 SUSE Bug 1255732 https://bugzilla.suse.com/1255733 SUSE Bug 1255733 https://bugzilla.suse.com/1255734 SUSE Bug 1255734 https://bugzilla.suse.com/1256105 SUSE Bug 1256105 https://www.suse.com/security/cve/CVE-2025-14017/ SUSE CVE CVE-2025-14017 page https://www.suse.com/security/cve/CVE-2025-14524/ SUSE CVE CVE-2025-14524 page https://www.suse.com/security/cve/CVE-2025-14819/ SUSE CVE CVE-2025-14819 page https://www.suse.com/security/cve/CVE-2025-15079/ SUSE CVE CVE-2025-15079 page https://www.suse.com/security/cve/CVE-2025-15224/ SUSE CVE CVE-2025-15224 page Container suse/sle-micro/base-5.5:latest Container suse/sle-micro/kvm-5.5:latest SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 curl-8.14.1-150400.5.77.1 libcurl4-8.14.1-150400.5.77.1 curl-fish-completion-8.14.1-150400.5.77.1 curl-zsh-completion-8.14.1-150400.5.77.1 libcurl-devel-8.14.1-150400.5.77.1 libcurl-devel-32bit-8.14.1-150400.5.77.1 libcurl-devel-64bit-8.14.1-150400.5.77.1 libcurl-devel-doc-8.14.1-150400.5.77.1 libcurl-mini4-8.14.1-150400.5.77.1 libcurl4-32bit-8.14.1-150400.5.77.1 libcurl4-64bit-8.14.1-150400.5.77.1 curl-8.14.1-150400.5.77.1 as a component of Container suse/sle-micro/base-5.5:latest libcurl4-8.14.1-150400.5.77.1 as a component of Container suse/sle-micro/base-5.5:latest libcurl4-8.14.1-150400.5.77.1 as a component of Container suse/sle-micro/kvm-5.5:latest curl-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.3 libcurl4-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.3 curl-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.4 libcurl4-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.4 curl-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.5 libcurl4-8.14.1-150400.5.77.1 as a component of SUSE Linux Enterprise Micro 5.5 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. CVE-2025-14017 Container suse/sle-micro/base-5.5:latest:curl-8.14.1-150400.5.77.1 Container suse/sle-micro/base-5.5:latest:libcurl4-8.14.1-150400.5.77.1 Container suse/sle-micro/kvm-5.5:latest:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ https://www.suse.com/security/cve/CVE-2025-14017.html CVE-2025-14017 https://bugzilla.suse.com/1256105 SUSE Bug 1256105 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. CVE-2025-14524 Container suse/sle-micro/base-5.5:latest:curl-8.14.1-150400.5.77.1 Container suse/sle-micro/base-5.5:latest:libcurl4-8.14.1-150400.5.77.1 Container suse/sle-micro/kvm-5.5:latest:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ https://www.suse.com/security/cve/CVE-2025-14524.html CVE-2025-14524 https://bugzilla.suse.com/1255731 SUSE Bug 1255731 When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. CVE-2025-14819 Container suse/sle-micro/base-5.5:latest:curl-8.14.1-150400.5.77.1 Container suse/sle-micro/base-5.5:latest:libcurl4-8.14.1-150400.5.77.1 Container suse/sle-micro/kvm-5.5:latest:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ https://www.suse.com/security/cve/CVE-2025-14819.html CVE-2025-14819 https://bugzilla.suse.com/1255732 SUSE Bug 1255732 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. CVE-2025-15079 Container suse/sle-micro/base-5.5:latest:curl-8.14.1-150400.5.77.1 Container suse/sle-micro/base-5.5:latest:libcurl4-8.14.1-150400.5.77.1 Container suse/sle-micro/kvm-5.5:latest:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ https://www.suse.com/security/cve/CVE-2025-15079.html CVE-2025-15079 https://bugzilla.suse.com/1255733 SUSE Bug 1255733 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. CVE-2025-15224 Container suse/sle-micro/base-5.5:latest:curl-8.14.1-150400.5.77.1 Container suse/sle-micro/base-5.5:latest:libcurl4-8.14.1-150400.5.77.1 Container suse/sle-micro/kvm-5.5:latest:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.3:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.4:libcurl4-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:curl-8.14.1-150400.5.77.1 SUSE Linux Enterprise Micro 5.5:libcurl4-8.14.1-150400.5.77.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260508-1/ https://www.suse.com/security/cve/CVE-2025-15224.html CVE-2025-15224 https://bugzilla.suse.com/1255734 SUSE Bug 1255734