An update for curl is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4852 Final 1.0 1.0 2026-11-11 Initial 2026-11-11 2026-11-11 openEuler SA Tool V1.0 2026-11-11 curl security update An update for curl is now available for openEuler-24.03-LTS-SP3 cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send.(CVE-2026-107928) Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.(CVE-2026-86409) A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.(CVE-2026-86410) An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.(CVE-2026-86414) Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.(CVE-2026-87862) An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.(CVE-2026-87863) Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.(CVE-2026-87864) When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.(CVE-2026-87865) When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.(CVE-2026-87866) When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.(CVE-2026-92386) When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.(CVE-2026-92388) libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.(CVE-2026-92389) When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.(CVE-2026-92390) A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.(CVE-2026-92391) libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.(CVE-2026-94266) An update for curl is now available for openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium curl https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-107928 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86409 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86410 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86414 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-87862 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-87863 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-87864 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-87865 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-87866 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92386 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92388 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92389 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92390 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-92391 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-94266 https://nvd.nist.gov/vuln/detail/CVE-2026-107928 https://nvd.nist.gov/vuln/detail/CVE-2026-86409 https://nvd.nist.gov/vuln/detail/CVE-2026-86410 https://nvd.nist.gov/vuln/detail/CVE-2026-86414 https://nvd.nist.gov/vuln/detail/CVE-2026-87862 https://nvd.nist.gov/vuln/detail/CVE-2026-87863 https://nvd.nist.gov/vuln/detail/CVE-2026-87864 https://nvd.nist.gov/vuln/detail/CVE-2026-87865 https://nvd.nist.gov/vuln/detail/CVE-2026-87866 https://nvd.nist.gov/vuln/detail/CVE-2026-92386 https://nvd.nist.gov/vuln/detail/CVE-2026-92388 https://nvd.nist.gov/vuln/detail/CVE-2026-92389 https://nvd.nist.gov/vuln/detail/CVE-2026-92390 https://nvd.nist.gov/vuln/detail/CVE-2026-92391 https://nvd.nist.gov/vuln/detail/CVE-2026-94266 openEuler-24.03-LTS-SP3 curl-8.4.0-38.oe2403sp3.src.rpm curl-8.4.0-38.oe2403sp3.x86_64.rpm curl-debuginfo-8.4.0-38.oe2403sp3.x86_64.rpm curl-debugsource-8.4.0-38.oe2403sp3.x86_64.rpm libcurl-8.4.0-38.oe2403sp3.x86_64.rpm libcurl-devel-8.4.0-38.oe2403sp3.x86_64.rpm curl-help-8.4.0-38.oe2403sp3.noarch.rpm curl-8.4.0-38.oe2403sp3.aarch64.rpm curl-debuginfo-8.4.0-38.oe2403sp3.aarch64.rpm curl-debugsource-8.4.0-38.oe2403sp3.aarch64.rpm libcurl-8.4.0-38.oe2403sp3.aarch64.rpm libcurl-devel-8.4.0-38.oe2403sp3.aarch64.rpm When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was given to send**. GnuTLS does that after a blocked send. 2026-11-11 CVE-2026-107928 openEuler-24.03-LTS-SP3 Medium 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. 2026-11-11 CVE-2026-86409 openEuler-24.03-LTS-SP3 Medium 5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. 2026-11-11 CVE-2026-86410 openEuler-24.03-LTS-SP3 Medium 6.8 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`. 2026-11-11 CVE-2026-86414 openEuler-24.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS. 2026-11-11 CVE-2026-87862 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss. 2026-11-11 CVE-2026-87863 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session. 2026-11-11 CVE-2026-87864 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback. 2026-11-11 CVE-2026-87865 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key. 2026-11-11 CVE-2026-87866 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file. 2026-11-11 CVE-2026-92386 openEuler-24.03-LTS-SP3 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer. 2026-11-11 CVE-2026-92388 openEuler-24.03-LTS-SP3 Medium 6.5 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle. 2026-11-11 CVE-2026-92389 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint. 2026-11-11 CVE-2026-92390 openEuler-24.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process. 2026-11-11 CVE-2026-92391 openEuler-24.03-LTS-SP3 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. 2026-11-11 CVE-2026-94266 openEuler-24.03-LTS-SP3 Low 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N curl security update 2026-11-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4852