Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

SUSE: Curl Important Fixes for Cookie and WebSocket 2025:20824-1

suse
Calendar Grey October 14, 2025
Dist Suse Esm H88
Stay updated with the latest SUSE security advisory for curl addressing critical issues and important fixes.
* bsc#1246197 * bsc#1249191 * bsc#1249348 * bsc#1249367 * jsc#PED-13055

Summary

## This update for curl fixes the following issues: * CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191) * CVE-2025-10148: Predictable WebSocket mask (bsc#1249348) * Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197] * tool_operate: fix return code when --retry is used but not triggered [bsc#1249367] * Updated to 8.14.1: [jsc#PED-13055, jsc#PED-13056] * Add _multibuild * Bugfixes: * asyn-thrdd: fix cleanup when RR fails due to OOM * ftp: fix teardown of DATA connection in done * http: fail early when rewind of input failed when following redirects * multi: fix add_handle resizing * tls BIOs: handle BIO_CTRL_EOF correctly * tool_getparam: make --no-anyauth not be accepted * wolfssl: fix sending of early data * ws: handle blocked sends better * ws: tests and fixes

Topics%20covered

Topics Covered

security advisory SuSE important curl cookie issue websocket mask

References

* bsc#1246197

* bsc#1249191

* bsc#1249348

* bsc#1249367

* jsc#PED-13055

* jsc#PED-13056

Cross-

* CVE-2025-10148

* CVE-2025-9086

CVSS scores:

* CVE-2025-10148 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2025-9086 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2025-9086 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* SUSE Linux Micro 6.0

An update that solves two vulnerabilities, contains two features and has two

fixes can now be installed.

##

* https://www.suse.com/security/cve/CVE-2025-10148.html

* https://www.suse.com/security/cve/CVE-2025-9086.html

* https://bugzilla.suse.com/show_bug.cgi?id=1246197

* https://bugzilla.suse.com/show_bug.cgi?id=1249191

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:20824-1
Release Date: 2025-09-25T10:50:20Z
Rating: important

Topics%20covered

Topics Covered

security advisory SuSE important curl cookie issue websocket mask

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here