1. Ubuntu Security Notices
  2. USN-8927-1

USN-8927-1: curl vulnerabilities

Publication date

14 October 2026

Overview

Several security issues were fixed in curl.

Releases

Packages

  • curl - HTTP, HTTPS, and FTP client and client libraries

Details

It was discovered that curl, when built with GnuTLS support, had an
out-of-bounds read in the WebSocket send path. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-107928)

Maksim discovered that curl did not correctly include the interface
binding in connection reuse decisions when CURLOPT_INTERFACE was used.
An attacker could possibly use this issue to cause connections to go
out from an unintended source address. (CVE-2026-107929)

Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-86409)

Stanislav Fort discovered that the curl command line tool did not set
SSH host verification options when following...

It was discovered that curl, when built with GnuTLS support, had an
out-of-bounds read in the WebSocket send path. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-107928)

Maksim discovered that curl did not correctly include the interface
binding in connection reuse decisions when CURLOPT_INTERFACE was used.
An attacker could possibly use this issue to cause connections to go
out from an unintended source address. (CVE-2026-107929)

Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-86409)

Stanislav Fort discovered that the curl command line tool did not set
SSH host verification options when following redirects to SFTP or SCP
URLs. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-86410)

Stanislav Fort discovered that curl did not properly handle cookie jar
entries that could not be reloaded. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-86412)

Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)

Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. (CVE-2026-87862)

Stanislav Fort discovered that curl did not properly handle HSTS
max-age values that exceeded calendar time structure bounds. An
attacker could possibly use this issue to cause a denial of service or
data loss. (CVE-2026-87863)

Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)

Bobbeh Rhino discovered that libcurl, when used with libssh2 and a
hashed known_hosts file, could misreport a host key mismatch as a
missing key. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-87865)

Joshua Rogers discovered that curl did not properly handle long cookie
entries written to a Netscape cookie jar. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-92386)

Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP
server could cause libcurl to block indefinitely by omitting the final
control-response line. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-92387)

Joshua Rogers discovered that libcurl had a use-after-free
vulnerability in the FTP wildcard matching code. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-92388)

Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-92389)

Joshua Rogers discovered that curl did not properly enforce its file
overwrite protection when using --remote-header-name in certain
circumstances. An attacker could possibly use this issue to overwrite
local files. (CVE-2026-92390)

Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service. (CVE-2026-92391)

Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-94266)

Joshua Rogers discovered that libcurl had a use-after-free
vulnerability during HTTP/2 uploads when handling RST_STREAM responses
from the server. An attacker could possibly use this issue to cause
curl to crash, resulting in a denial of service, or execute arbitrary
code. (CVE-2026-92392)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute curl –  8.18.0-1ubuntu2.8
libcurl3t64-gnutls –  8.18.0-1ubuntu2.8
libcurl4t64 –  8.18.0-1ubuntu2.8

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›