Home / mailings [USN-8820-1] curl vulnerabilities
Posted on 24 September 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8820-1
September 24, 2026
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for
LDAP authentication in certain circumstances. A machine-in-the-middle
attacker could possibly use this issue to bypass peer validation. This
issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-13608)
Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server
Push streams when sharing connections between handles. A remote attacker
could possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-18924)
Stanislav Fort discovered that curl incorrectly managed the lifetime of
pooled TLS connections when using the multi interface. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service, or execute arbitrary code. This issue only affected Ubuntu 26.04
LTS. (CVE-2026-80229)
Stanislav Fort discovered that curl did not properly enforce public key
pinning when certificate verification was disabled in certain
circumstances. A remote attacker could possibly use this issue to bypass
pinning checks and cause curl to accept connections that should have been
rejected. (CVE-2026-80230)
Stanislav Fort discovered that curl incorrectly handled the Secure
attribute of cookies in certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-80255)
Stanislav Fort discovered that curl did not properly enforce Public
Suffix List boundaries when handling cookies in certain circumstances. A
remote attacker could possibly use this issue to cause cookies to be sent
to unrelated domains, resulting in sensitive information being exposed.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)
Ady Elouej discovered that curl did not clear proxy authentication state
between requests when reusing a handle with environment-variable proxy
configuration. A remote attacker could possibly use this issue to obtain
sensitive credentials. This issue was previously fixed in USN-8487-1, but
that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
curl 8.18.0-1ubuntu2.7
libcurl3t64-gnutls 8.18.0-1ubuntu2.7
libcurl4-gnutls-dev 8.18.0-1ubuntu2.7
libcurl4-openssl-dev 8.18.0-1ubuntu2.7
libcurl4t64 8.18.0-1ubuntu2.7
Ubuntu 24.04 LTS
curl 8.5.0-2ubuntu10.15
libcurl3t64-gnutls 8.5.0-2ubuntu10.15
libcurl4-gnutls-dev 8.5.0-2ubuntu10.15
libcurl4-openssl-dev 8.5.0-2ubuntu10.15
libcurl4t64 8.5.0-2ubuntu10.15
Ubuntu 22.04 LTS
curl 7.81.0-1ubuntu1.29
libcurl3-gnutls 7.81.0-1ubuntu1.29
libcurl3-nss 7.81.0-1ubuntu1.29
libcurl4 7.81.0-1ubuntu1.29
libcurl4-gnutls-dev 7.81.0-1ubuntu1.29
libcurl4-nss-dev 7.81.0-1ubuntu1.29
libcurl4-openssl-dev 7.81.0-1ubuntu1.29
Ubuntu 20.04 LTS
curl 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl3-gnutls 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl3-nss 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl4 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl4-nss-dev 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
libcurl4-openssl-dev 7.68.0-1ubuntu2.25+esm9
Available with Ubuntu Pro
Ubuntu 18.04 LTS
curl 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl3-gnutls 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl3-nss 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl4 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl4-nss-dev 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
libcurl4-openssl-dev 7.58.0-2ubuntu3.24+esm14
Available with Ubuntu Pro
Ubuntu 16.04 LTS
curl 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl3 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl3-gnutls 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl3-nss 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl4-nss-dev 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
libcurl4-openssl-dev 7.47.0-1ubuntu2.19+esm20
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8820-1
CVE-2026-13608, CVE-2026-18924, CVE-2026-80229, CVE-2026-80230,
CVE-2026-80255, CVE-2026-82209, CVE-2026-8927, CVE-2026-9080
Package Information:
https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.7
https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.15
https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.29
--===============3119161077532498630==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
