Home / mailings

PDF

[USN-8932-1] curl vulnerabilities

Posted on 14 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8932-1
October 14, 2026

curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in curl.

Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-86409)

Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)

Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862)

Stanislav Fort discovered that curl did not properly handle HSTS max-age
values that exceeded calendar time structure bounds. An attacker could
possibly use this issue to cause a denial of service or data loss. This
issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863)

Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)

Joshua Rogers discovered that libcurl had a use-after-free vulnerability
in the FTP wildcard matching code. An attacker could possibly use this
issue to cause curl to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-92388)

Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-92389)

Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391)

Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
curl 8.5.0-2ubuntu10.16
libcurl3t64-gnutls 8.5.0-2ubuntu10.16
libcurl4-gnutls-dev 8.5.0-2ubuntu10.16
libcurl4-openssl-dev 8.5.0-2ubuntu10.16
libcurl4t64 8.5.0-2ubuntu10.16

Ubuntu 22.04 LTS
curl 7.81.0-1ubuntu1.30
libcurl3-gnutls 7.81.0-1ubuntu1.30
libcurl3-nss 7.81.0-1ubuntu1.30
libcurl4 7.81.0-1ubuntu1.30
libcurl4-gnutls-dev 7.81.0-1ubuntu1.30
libcurl4-nss-dev 7.81.0-1ubuntu1.30
libcurl4-openssl-dev 7.81.0-1ubuntu1.30

Ubuntu 20.04 LTS
curl 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl3-gnutls 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl3-nss 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl4 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl4-nss-dev 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro
libcurl4-openssl-dev 7.68.0-1ubuntu2.25+esm10
Available with Ubuntu Pro

Ubuntu 18.04 LTS
curl 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl3-gnutls 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl3-nss 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl4 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl4-nss-dev 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro
libcurl4-openssl-dev 7.58.0-2ubuntu3.24+esm15
Available with Ubuntu Pro

Ubuntu 16.04 LTS
curl 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl3 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl3-gnutls 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl3-nss 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl4-nss-dev 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro
libcurl4-openssl-dev 7.47.0-1ubuntu2.19+esm21
Available with Ubuntu Pro

Ubuntu 14.04 LTS
curl 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl3 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl3-gnutls 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl3-nss 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl4-nss-dev 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro
libcurl4-openssl-dev 7.35.0-1ubuntu2.20+esm24
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8932-1
CVE-2026-86409, CVE-2026-86414, CVE-2026-87862, CVE-2026-87863,
CVE-2026-87864, CVE-2026-92388, CVE-2026-92389, CVE-2026-92391,
CVE-2026-94266

Package Information:
https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.16
https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.30

--===============2674390272479970495==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP