Vulnerability-Lookup

CVE-2025-14524 (GCVE-0-2025-14524)

Vulnerability from cvelistv5 – Published: 2026-01-08 10:07 – Updated: 2026-01-09 19:25

Title

bearer token leak on cross-protocol redirect

Summary

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-522 Insufficiently Protected Credentials

Assigner

curl

References

URL

Tags

	https://curl.se/docs/CVE-2025-14524.json
	https://curl.se/docs/CVE-2025-14524.html
	https://hackerone.com/reports/3459417

Impacted products

	Vendor	Product	Version
	curl	curl	Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver) Affected: 7.68.0 , ≤ 7.68.0 (semver) Affected: 7.67.0 , ≤ 7.67.0 (semver) Affected: 7.66.0 , ≤ 7.66.0 (semver) Affected: 7.65.3 , ≤ 7.65.3 (semver) Affected: 7.65.2 , ≤ 7.65.2 (semver) Affected: 7.65.1 , ≤ 7.65.1 (semver) Affected: 7.65.0 , ≤ 7.65.0 (semver) Affected: 7.64.1 , ≤ 7.64.1 (semver) Affected: 7.64.0 , ≤ 7.64.0 (semver) Affected: 7.63.0 , ≤ 7.63.0 (semver) Affected: 7.62.0 , ≤ 7.62.0 (semver) Affected: 7.61.1 , ≤ 7.61.1 (semver) Affected: 7.61.0 , ≤ 7.61.0 (semver) Affected: 7.60.0 , ≤ 7.60.0 (semver) Affected: 7.59.0 , ≤ 7.59.0 (semver) Affected: 7.58.0 , ≤ 7.58.0 (semver) Affected: 7.57.0 , ≤ 7.57.0 (semver) Affected: 7.56.1 , ≤ 7.56.1 (semver) Affected: 7.56.0 , ≤ 7.56.0 (semver) Affected: 7.55.1 , ≤ 7.55.1 (semver) Affected: 7.55.0 , ≤ 7.55.0 (semver) Affected: 7.54.1 , ≤ 7.54.1 (semver) Affected: 7.54.0 , ≤ 7.54.0 (semver) Affected: 7.53.1 , ≤ 7.53.1 (semver) Affected: 7.53.0 , ≤ 7.53.0 (semver) Affected: 7.52.1 , ≤ 7.52.1 (semver) Affected: 7.52.0 , ≤ 7.52.0 (semver) Affected: 7.51.0 , ≤ 7.51.0 (semver) Affected: 7.50.3 , ≤ 7.50.3 (semver) Affected: 7.50.2 , ≤ 7.50.2 (semver) Affected: 7.50.1 , ≤ 7.50.1 (semver) Affected: 7.50.0 , ≤ 7.50.0 (semver) Affected: 7.49.1 , ≤ 7.49.1 (semver) Affected: 7.49.0 , ≤ 7.49.0 (semver) Affected: 7.48.0 , ≤ 7.48.0 (semver) Affected: 7.47.1 , ≤ 7.47.1 (semver) Affected: 7.47.0 , ≤ 7.47.0 (semver) Affected: 7.46.0 , ≤ 7.46.0 (semver) Affected: 7.45.0 , ≤ 7.45.0 (semver) Affected: 7.44.0 , ≤ 7.44.0 (semver) Affected: 7.43.0 , ≤ 7.43.0 (semver) Affected: 7.42.1 , ≤ 7.42.1 (semver) Affected: 7.42.0 , ≤ 7.42.0 (semver) Affected: 7.41.0 , ≤ 7.41.0 (semver) Affected: 7.40.0 , ≤ 7.40.0 (semver) Affected: 7.39.0 , ≤ 7.39.0 (semver) Affected: 7.38.0 , ≤ 7.38.0 (semver) Affected: 7.37.1 , ≤ 7.37.1 (semver) Affected: 7.37.0 , ≤ 7.37.0 (semver) Affected: 7.36.0 , ≤ 7.36.0 (semver) Affected: 7.35.0 , ≤ 7.35.0 (semver) Affected: 7.34.0 , ≤ 7.34.0 (semver) Affected: 7.33.0 , ≤ 7.33.0 (semver)

Credits

anonymous237 on hackerone Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-08T11:06:18.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-09T19:24:54.231955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-09T19:25:30.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.68.0",
              "status": "affected",
              "version": "7.68.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.67.0",
              "status": "affected",
              "version": "7.67.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.66.0",
              "status": "affected",
              "version": "7.66.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.3",
              "status": "affected",
              "version": "7.65.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.2",
              "status": "affected",
              "version": "7.65.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.1",
              "status": "affected",
              "version": "7.65.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.65.0",
              "status": "affected",
              "version": "7.65.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.1",
              "status": "affected",
              "version": "7.64.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.64.0",
              "status": "affected",
              "version": "7.64.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.63.0",
              "status": "affected",
              "version": "7.63.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.62.0",
              "status": "affected",
              "version": "7.62.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.1",
              "status": "affected",
              "version": "7.61.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.61.0",
              "status": "affected",
              "version": "7.61.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.60.0",
              "status": "affected",
              "version": "7.60.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.59.0",
              "status": "affected",
              "version": "7.59.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.58.0",
              "status": "affected",
              "version": "7.58.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.57.0",
              "status": "affected",
              "version": "7.57.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.1",
              "status": "affected",
              "version": "7.56.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.56.0",
              "status": "affected",
              "version": "7.56.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.1",
              "status": "affected",
              "version": "7.55.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.55.0",
              "status": "affected",
              "version": "7.55.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.1",
              "status": "affected",
              "version": "7.54.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.54.0",
              "status": "affected",
              "version": "7.54.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.1",
              "status": "affected",
              "version": "7.53.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.53.0",
              "status": "affected",
              "version": "7.53.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.1",
              "status": "affected",
              "version": "7.52.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.52.0",
              "status": "affected",
              "version": "7.52.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.51.0",
              "status": "affected",
              "version": "7.51.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.3",
              "status": "affected",
              "version": "7.50.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.2",
              "status": "affected",
              "version": "7.50.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.1",
              "status": "affected",
              "version": "7.50.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.50.0",
              "status": "affected",
              "version": "7.50.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.1",
              "status": "affected",
              "version": "7.49.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.49.0",
              "status": "affected",
              "version": "7.49.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.48.0",
              "status": "affected",
              "version": "7.48.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.1",
              "status": "affected",
              "version": "7.47.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.47.0",
              "status": "affected",
              "version": "7.47.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.46.0",
              "status": "affected",
              "version": "7.46.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.45.0",
              "status": "affected",
              "version": "7.45.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.44.0",
              "status": "affected",
              "version": "7.44.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.43.0",
              "status": "affected",
              "version": "7.43.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.1",
              "status": "affected",
              "version": "7.42.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.42.0",
              "status": "affected",
              "version": "7.42.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.41.0",
              "status": "affected",
              "version": "7.41.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.40.0",
              "status": "affected",
              "version": "7.40.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.39.0",
              "status": "affected",
              "version": "7.39.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.38.0",
              "status": "affected",
              "version": "7.38.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.1",
              "status": "affected",
              "version": "7.37.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.37.0",
              "status": "affected",
              "version": "7.37.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.36.0",
              "status": "affected",
              "version": "7.36.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.35.0",
              "status": "affected",
              "version": "7.35.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.34.0",
              "status": "affected",
              "version": "7.34.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.33.0",
              "status": "affected",
              "version": "7.33.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "anonymous237 on hackerone"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T10:07:25.655Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2025-14524.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2025-14524.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/3459417"
        }
      ],
      "title": "bearer token leak on cross-protocol redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-14524",
    "datePublished": "2026-01-08T10:07:25.655Z",
    "dateReserved": "2025-12-11T08:04:14.328Z",
    "dateUpdated": "2026-01-09T19:25:30.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-14524\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2026-01-08T10:15:46.607\",\"lastModified\":\"2026-01-09T20:15:51.243\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\\ntarget host.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://curl.se/docs/CVE-2025-14524.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\"},{\"url\":\"https://curl.se/docs/CVE-2025-14524.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\"},{\"url\":\"https://hackerone.com/reports/3459417\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/01/07/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14524\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-09T19:24:54.231955Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-01-09T19:25:18.454Z\"}}], \"cna\": {\"title\": \"bearer token leak on cross-protocol redirect\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"anonymous237 on hackerone\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Daniel Stenberg\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.17.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.17.0\"}, {\"status\": \"affected\", \"version\": \"8.16.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.16.0\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.0\"}, {\"status\": \"affected\", \"version\": \"8.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.74.0\"}, {\"status\": \"affected\", \"version\": \"7.73.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.73.0\"}, {\"status\": \"affected\", \"version\": \"7.72.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.72.0\"}, {\"status\": \"affected\", \"version\": \"7.71.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.1\"}, {\"status\": \"affected\", \"version\": \"7.71.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.0\"}, {\"status\": \"affected\", \"version\": \"7.70.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.70.0\"}, {\"status\": \"affected\", \"version\": \"7.69.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.1\"}, {\"status\": \"affected\", \"version\": \"7.69.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.0\"}, {\"status\": \"affected\", \"version\": \"7.68.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.68.0\"}, {\"status\": \"affected\", \"version\": \"7.67.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.67.0\"}, {\"status\": \"affected\", \"version\": \"7.66.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.66.0\"}, {\"status\": \"affected\", \"version\": \"7.65.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.3\"}, {\"status\": \"affected\", \"version\": \"7.65.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.2\"}, {\"status\": \"affected\", \"version\": \"7.65.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.1\"}, {\"status\": \"affected\", \"version\": \"7.65.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.0\"}, {\"status\": \"affected\", \"version\": \"7.64.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.1\"}, {\"status\": \"affected\", \"version\": \"7.64.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.0\"}, {\"status\": \"affected\", \"version\": \"7.63.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.63.0\"}, {\"status\": \"affected\", \"version\": \"7.62.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.62.0\"}, {\"status\": \"affected\", \"version\": \"7.61.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.1\"}, {\"status\": \"affected\", \"version\": \"7.61.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.0\"}, {\"status\": \"affected\", \"version\": \"7.60.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.60.0\"}, {\"status\": \"affected\", \"version\": \"7.59.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.59.0\"}, {\"status\": \"affected\", \"version\": \"7.58.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.58.0\"}, {\"status\": \"affected\", \"version\": \"7.57.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.57.0\"}, {\"status\": \"affected\", \"version\": \"7.56.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.1\"}, {\"status\": \"affected\", \"version\": \"7.56.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.56.0\"}, {\"status\": \"affected\", \"version\": \"7.55.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.1\"}, {\"status\": \"affected\", \"version\": \"7.55.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.55.0\"}, {\"status\": \"affected\", \"version\": \"7.54.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.1\"}, {\"status\": \"affected\", \"version\": \"7.54.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.54.0\"}, {\"status\": \"affected\", \"version\": \"7.53.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.1\"}, {\"status\": \"affected\", \"version\": \"7.53.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.53.0\"}, {\"status\": \"affected\", \"version\": \"7.52.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.1\"}, {\"status\": \"affected\", \"version\": \"7.52.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.52.0\"}, {\"status\": \"affected\", \"version\": \"7.51.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.51.0\"}, {\"status\": \"affected\", \"version\": \"7.50.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.3\"}, {\"status\": \"affected\", \"version\": \"7.50.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.2\"}, {\"status\": \"affected\", \"version\": \"7.50.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.1\"}, {\"status\": \"affected\", \"version\": \"7.50.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.50.0\"}, {\"status\": \"affected\", \"version\": \"7.49.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.1\"}, {\"status\": \"affected\", \"version\": \"7.49.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.49.0\"}, {\"status\": \"affected\", \"version\": \"7.48.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.48.0\"}, {\"status\": \"affected\", \"version\": \"7.47.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.1\"}, {\"status\": \"affected\", \"version\": \"7.47.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.47.0\"}, {\"status\": \"affected\", \"version\": \"7.46.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.46.0\"}, {\"status\": \"affected\", \"version\": \"7.45.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.45.0\"}, {\"status\": \"affected\", \"version\": \"7.44.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.44.0\"}, {\"status\": \"affected\", \"version\": \"7.43.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.43.0\"}, {\"status\": \"affected\", \"version\": \"7.42.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.1\"}, {\"status\": \"affected\", \"version\": \"7.42.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.42.0\"}, {\"status\": \"affected\", \"version\": \"7.41.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.41.0\"}, {\"status\": \"affected\", \"version\": \"7.40.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.40.0\"}, {\"status\": \"affected\", \"version\": \"7.39.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.39.0\"}, {\"status\": \"affected\", \"version\": \"7.38.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.38.0\"}, {\"status\": \"affected\", \"version\": \"7.37.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.1\"}, {\"status\": \"affected\", \"version\": \"7.37.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.37.0\"}, {\"status\": \"affected\", \"version\": \"7.36.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.36.0\"}, {\"status\": \"affected\", \"version\": \"7.35.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.35.0\"}, {\"status\": \"affected\", \"version\": \"7.34.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.34.0\"}, {\"status\": \"affected\", \"version\": \"7.33.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.33.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2025-14524.json\", \"name\": \"json\"}, {\"url\": \"https://curl.se/docs/CVE-2025-14524.html\", \"name\": \"www\"}, {\"url\": \"https://hackerone.com/reports/3459417\", \"name\": \"issue\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\\ntarget host.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-01-08T10:07:25.655Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-14524\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-08T11:06:18.117Z\", \"dateReserved\": \"2025-12-11T08:04:14.328Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2026-01-08T10:07:25.655Z\", \"assignerShortName\": \"curl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SUSE-SU-2026:0051-1

Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28

Summary

Security update for curl

Notes

Title of the patch

Security update for curl

Description of the patch

This update for curl fixes the following issues: - CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731). - CVE-2025-14819: libssh global knownhost override (bsc#1255732). - CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733). - CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

Patchnames

SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0051-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0051-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260051-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0051-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-07T09:28:27Z",
      "generator": {
        "date": "2026-01-07T09:28:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0051-1",
      "initial_release_date": "2026-01-07T09:28:27Z",
      "revision_history": [
        {
          "date": "2026-01-07T09:28:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "curl-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.i586",
                  "product_id": "curl-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.i586",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150200.4.97.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "curl-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.s390x",
                  "product_id": "curl-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.s390x",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "curl-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150200.4.97.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.2",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.2",
                  "product_id": "SUSE Linux Enterprise Micro 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-microos:5.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150200.4.97.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
          "product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150200.4.97.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
          "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
            "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:0052-1

Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28

Summary

Security update for curl

Notes

Title of the patch

Security update for curl

Description of the patch

Patchnames

SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0052-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0052-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260052-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0052-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-07T09:28:37Z",
      "generator": {
        "date": "2026-01-07T09:28:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0052-1",
      "initial_release_date": "2026-01-07T09:28:37Z",
      "revision_history": [
        {
          "date": "2026-01-07T09:28:37Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "curl-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.i586",
                  "product_id": "curl-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.i586",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150700.7.8.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "curl-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.s390x",
                  "product_id": "curl-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.s390x",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "curl-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150700.7.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
        },
        "product_reference": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

SUSE-SU-2026:0066-1

Vulnerability from csaf_suse - Published: 2026-01-08 12:21 - Updated: 2026-01-08 12:21

Summary

Security update for curl

Notes

Title of the patch

Security update for curl

Description of the patch

This update for curl fixes the following issues: - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731) - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733) - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)

Patchnames

SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n  - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)\n  - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)\n  - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could\n  accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0066-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0066-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260066-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0066-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-08T12:21:35Z",
      "generator": {
        "date": "2026-01-08T12:21:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0066-1",
      "initial_release_date": "2026-01-08T12:21:35Z",
      "revision_history": [
        {
          "date": "2026-01-08T12:21:35Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "curl-8.0.1-11.111.1.aarch64",
                  "product_id": "curl-8.0.1-11.111.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.aarch64",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.aarch64",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.aarch64",
                  "product_id": "libcurl4-8.0.1-11.111.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.i586",
                "product": {
                  "name": "curl-8.0.1-11.111.1.i586",
                  "product_id": "curl-8.0.1-11.111.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.i586",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.i586",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.i586",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.i586",
                  "product_id": "libcurl4-8.0.1-11.111.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "curl-8.0.1-11.111.1.ppc64le",
                  "product_id": "curl-8.0.1-11.111.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.ppc64le",
                  "product_id": "libcurl4-8.0.1-11.111.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.s390",
                "product": {
                  "name": "curl-8.0.1-11.111.1.s390",
                  "product_id": "curl-8.0.1-11.111.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.s390",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.s390",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.s390",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.s390",
                  "product_id": "libcurl4-8.0.1-11.111.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "curl-8.0.1-11.111.1.s390x",
                  "product_id": "curl-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl-devel-32bit-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl4-8.0.1-11.111.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
                "product": {
                  "name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
                  "product_id": "libcurl4-32bit-8.0.1-11.111.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "curl-8.0.1-11.111.1.x86_64",
                  "product_id": "curl-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl-devel-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl4-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl4-8.0.1-11.111.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
                  "product_id": "libcurl4-32bit-8.0.1-11.111.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "curl-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl4-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-32bit-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64"
        },
        "product_reference": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing TLS related transfers with reused easy or multi handles and\naltering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-08T12:21:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    }
  ]
}

SUSE-SU-2026:0050-1

Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28

Summary

Security update for curl

Notes

Title of the patch

Security update for curl

Description of the patch

Patchnames

SUSE-2026-50,openSUSE-SLE-15.6-2026-50

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for curl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-50,openSUSE-SLE-15.6-2026-50",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0050-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0050-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260050-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0050-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023698.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255731",
        "url": "https://bugzilla.suse.com/1255731"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255732",
        "url": "https://bugzilla.suse.com/1255732"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255733",
        "url": "https://bugzilla.suse.com/1255733"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255734",
        "url": "https://bugzilla.suse.com/1255734"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14524 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14524/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14819 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14819/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15079 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15224/"
      }
    ],
    "title": "Security update for curl",
    "tracking": {
      "current_release_date": "2026-01-07T09:28:15Z",
      "generator": {
        "date": "2026-01-07T09:28:15Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0050-1",
      "initial_release_date": "2026-01-07T09:28:15Z",
      "revision_history": [
        {
          "date": "2026-01-07T09:28:15Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150600.4.34.1.aarch64",
                "product": {
                  "name": "curl-8.14.1-150600.4.34.1.aarch64",
                  "product_id": "curl-8.14.1-150600.4.34.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
                  "product_id": "libcurl-devel-8.14.1-150600.4.34.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64",
                  "product_id": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150600.4.34.1.aarch64",
                "product": {
                  "name": "libcurl4-8.14.1-150600.4.34.1.aarch64",
                  "product_id": "libcurl4-8.14.1-150600.4.34.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
                  "product_id": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
                "product": {
                  "name": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
                  "product_id": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150600.4.34.1.i586",
                "product": {
                  "name": "curl-8.14.1-150600.4.34.1.i586",
                  "product_id": "curl-8.14.1-150600.4.34.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150600.4.34.1.i586",
                "product": {
                  "name": "libcurl-devel-8.14.1-150600.4.34.1.i586",
                  "product_id": "libcurl-devel-8.14.1-150600.4.34.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150600.4.34.1.i586",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150600.4.34.1.i586",
                  "product_id": "libcurl-mini4-8.14.1-150600.4.34.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150600.4.34.1.i586",
                "product": {
                  "name": "libcurl4-8.14.1-150600.4.34.1.i586",
                  "product_id": "libcurl4-8.14.1-150600.4.34.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-fish-completion-8.14.1-150600.4.34.1.noarch",
                "product": {
                  "name": "curl-fish-completion-8.14.1-150600.4.34.1.noarch",
                  "product_id": "curl-fish-completion-8.14.1-150600.4.34.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch",
                "product": {
                  "name": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch",
                  "product_id": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch",
                "product": {
                  "name": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch",
                  "product_id": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150600.4.34.1.ppc64le",
                "product": {
                  "name": "curl-8.14.1-150600.4.34.1.ppc64le",
                  "product_id": "curl-8.14.1-150600.4.34.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
                "product": {
                  "name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
                  "product_id": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le",
                  "product_id": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
                "product": {
                  "name": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
                  "product_id": "libcurl4-8.14.1-150600.4.34.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150600.4.34.1.s390x",
                "product": {
                  "name": "curl-8.14.1-150600.4.34.1.s390x",
                  "product_id": "curl-8.14.1-150600.4.34.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
                "product": {
                  "name": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
                  "product_id": "libcurl-devel-8.14.1-150600.4.34.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150600.4.34.1.s390x",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150600.4.34.1.s390x",
                  "product_id": "libcurl-mini4-8.14.1-150600.4.34.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150600.4.34.1.s390x",
                "product": {
                  "name": "libcurl4-8.14.1-150600.4.34.1.s390x",
                  "product_id": "libcurl4-8.14.1-150600.4.34.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "curl-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "curl-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "curl-8.14.1-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "libcurl-devel-8.14.1-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "libcurl4-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "libcurl4-8.14.1-150600.4.34.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
                "product": {
                  "name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
                  "product_id": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64"
        },
        "product_reference": "curl-8.14.1-150600.4.34.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le"
        },
        "product_reference": "curl-8.14.1-150600.4.34.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x"
        },
        "product_reference": "curl-8.14.1-150600.4.34.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "curl-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64"
        },
        "product_reference": "curl-8.14.1-150600.4.34.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64"
        },
        "product_reference": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le"
        },
        "product_reference": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x"
        },
        "product_reference": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64"
        },
        "product_reference": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64"
        },
        "product_reference": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64"
        },
        "product_reference": "libcurl4-8.14.1-150600.4.34.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le"
        },
        "product_reference": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x"
        },
        "product_reference": "libcurl4-8.14.1-150600.4.34.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
        },
        "product_reference": "libcurl4-8.14.1-150600.4.34.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64"
        },
        "product_reference": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14524"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14524",
          "url": "https://www.suse.com/security/cve/CVE-2025-14524"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255731 for CVE-2025-14524",
          "url": "https://bugzilla.suse.com/1255731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:15Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14819"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14819",
          "url": "https://www.suse.com/security/cve/CVE-2025-14819"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255732 for CVE-2025-14819",
          "url": "https://bugzilla.suse.com/1255732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:15Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15079",
          "url": "https://www.suse.com/security/cve/CVE-2025-15079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255733 for CVE-2025-15079",
          "url": "https://bugzilla.suse.com/1255733"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:15Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
          "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15224",
          "url": "https://www.suse.com/security/cve/CVE-2025-15224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255734 for CVE-2025-15224",
          "url": "https://bugzilla.suse.com/1255734"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
            "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-07T09:28:15Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15224"
    }
  ]
}

GHSA-G897-JVJX-78VG

Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-09 21:31

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-14524"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-08T10:15:46Z",
    "severity": "MODERATE"
  },
  "details": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
  "id": "GHSA-g897-jvjx-78vg",
  "modified": "2026-01-09T21:31:34Z",
  "published": "2026-01-08T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3459417"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2025-14524.html"
    },
    {
      "type": "WEB",
      "url": "https://curl.se/docs/CVE-2025-14524.json"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2025-14524

Vulnerability from fkie_nvd - Published: 2026-01-08 10:15 - Updated: 2026-01-09 20:15

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2025-14524.html
	2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2025-14524.json
	2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/3459417
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/01/07/4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."
    }
  ],
  "id": "CVE-2025-14524",
  "lastModified": "2026-01-09T20:15:51.243",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-08T10:15:46.607",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2025-14524.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2025-14524.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://hackerone.com/reports/3459417"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Awaiting Analysis"
}

WID-SEC-W-2026-0030

Vulnerability from csaf_certbund - Published: 2026-01-06 23:00 - Updated: 2026-01-08 23:00

Summary

cURL: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.

Angriff

Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges - UNIX

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0030 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0030.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0030 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0030"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-15224.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-15079.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14819.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14524.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-14017.html"
      },
      {
        "category": "external",
        "summary": "Project curl Security Advisory vom 2026-01-06",
        "url": "https://curl.se/docs/CVE-2025-13034.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0050-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023698.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0052-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0051-1 vom 2026-01-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:0066-1 vom 2026-01-08",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
      }
    ],
    "source_lang": "en-US",
    "title": "cURL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-08T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-09T07:30:25.162+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0030",
      "initial_release_date": "2026-01-06T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-06T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-01-07T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-01-08T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE und European Union Vulnerability Database aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.18.0",
                "product": {
                  "name": "Open Source cURL \u003c8.18.0",
                  "product_id": "T049738"
                }
              },
              {
                "category": "product_version",
                "name": "8.18.0",
                "product": {
                  "name": "Open Source cURL 8.18.0",
                  "product_id": "T049738-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:curl:curl:8.18.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "cURL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13034",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-13034"
    },
    {
      "cve": "CVE-2025-14017",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14017"
    },
    {
      "cve": "CVE-2025-14524",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-14819",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-14819"
    },
    {
      "cve": "CVE-2025-15079",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-15079"
    },
    {
      "cve": "CVE-2025-15224",
      "product_status": {
        "known_affected": [
          "T049738",
          "T002207"
        ]
      },
      "release_date": "2026-01-06T23:00:00.000+00:00",
      "title": "CVE-2025-15224"
    }
  ]
}

CERTFR-2026-AVI-0010

Vulnerability from certfr_avis - Published: 2026-01-07 - Updated: 2026-01-07

De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Curl	cURL et libcurl	Curl versions 7.17.x à 8.x antérieures à 8.18.0

References

Title

Publication Time

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-14524 (GCVE-0-2025-14524)

Solutions

Tags

Sightings

Nomenclature