An update for curl is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4124 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 curl security update An update for curl is now available for openEuler-20.03-LTS-SP4 cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.(CVE-2026-11856) A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.(CVE-2026-18924) A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.(CVE-2026-19931) When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.(CVE-2026-80230) A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.(CVE-2026-80231) When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).(CVE-2026-82209) An update for curl is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical curl https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-11856 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18924 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19931 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-80230 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-80231 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-82209 https://nvd.nist.gov/vuln/detail/CVE-2026-11856 https://nvd.nist.gov/vuln/detail/CVE-2026-18924 https://nvd.nist.gov/vuln/detail/CVE-2026-19931 https://nvd.nist.gov/vuln/detail/CVE-2026-80230 https://nvd.nist.gov/vuln/detail/CVE-2026-80231 https://nvd.nist.gov/vuln/detail/CVE-2026-82209 openEuler-20.03-LTS-SP4 curl-help-7.71.1-54.oe2003sp4.noarch.rpm curl-7.71.1-54.oe2003sp4.aarch64.rpm curl-debuginfo-7.71.1-54.oe2003sp4.aarch64.rpm curl-debugsource-7.71.1-54.oe2003sp4.aarch64.rpm libcurl-7.71.1-54.oe2003sp4.aarch64.rpm libcurl-devel-7.71.1-54.oe2003sp4.aarch64.rpm curl-7.71.1-54.oe2003sp4.src.rpm curl-7.71.1-54.oe2003sp4.x86_64.rpm curl-debuginfo-7.71.1-54.oe2003sp4.x86_64.rpm curl-debugsource-7.71.1-54.oe2003sp4.x86_64.rpm libcurl-7.71.1-54.oe2003sp4.x86_64.rpm libcurl-devel-7.71.1-54.oe2003sp4.x86_64.rpm Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. 2026-09-25 CVE-2026-11856 openEuler-20.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. 2026-09-25 CVE-2026-18924 openEuler-20.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. 2026-09-25 CVE-2026-19931 openEuler-20.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. 2026-09-25 CVE-2026-80230 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created. 2026-09-25 CVE-2026-80231 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`). 2026-09-25 CVE-2026-82209 openEuler-20.03-LTS-SP4 High 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N curl security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4124