An update for curl is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2986 Final 1.0 1.0 2026-07-19 Initial 2026-07-19 2026-07-19 openEuler SA Tool V1.0 2026-07-19 curl security update An update for curl is now available for openEuler-24.03-LTS-SP1 cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.(CVE-2026-10536) When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.(CVE-2026-12064) A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.(CVE-2026-8286) A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.(CVE-2026-8924) When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.(CVE-2026-8927) When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547) An update for curl is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High curl https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-10536 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-12064 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8286 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8924 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8927 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-9547 https://nvd.nist.gov/vuln/detail/CVE-2026-10536 https://nvd.nist.gov/vuln/detail/CVE-2026-12064 https://nvd.nist.gov/vuln/detail/CVE-2026-8286 https://nvd.nist.gov/vuln/detail/CVE-2026-8924 https://nvd.nist.gov/vuln/detail/CVE-2026-8927 https://nvd.nist.gov/vuln/detail/CVE-2026-9547 openEuler-24.03-LTS-SP1 curl-8.4.0-32.oe2403sp1.aarch64.rpm curl-debuginfo-8.4.0-32.oe2403sp1.aarch64.rpm curl-debugsource-8.4.0-32.oe2403sp1.aarch64.rpm libcurl-8.4.0-32.oe2403sp1.aarch64.rpm libcurl-devel-8.4.0-32.oe2403sp1.aarch64.rpm curl-8.4.0-32.oe2403sp1.src.rpm curl-8.4.0-32.oe2403sp1.x86_64.rpm curl-debuginfo-8.4.0-32.oe2403sp1.x86_64.rpm curl-debugsource-8.4.0-32.oe2403sp1.x86_64.rpm libcurl-8.4.0-32.oe2403sp1.x86_64.rpm libcurl-devel-8.4.0-32.oe2403sp1.x86_64.rpm curl-help-8.4.0-32.oe2403sp1.noarch.rpm A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. 2026-07-19 CVE-2026-10536 openEuler-24.03-LTS-SP1 Medium 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. 2026-07-19 CVE-2026-12064 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. 2026-07-19 CVE-2026-8286 openEuler-24.03-LTS-SP1 High 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. 2026-07-19 CVE-2026-8924 openEuler-24.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. 2026-07-19 CVE-2026-8927 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986 When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. 2026-07-19 CVE-2026-9547 openEuler-24.03-LTS-SP1 High 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N curl security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2986