Packages
- curl - HTTP, HTTPS, and FTP client and client libraries
Details
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-86409)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. This issue only affected
Ubuntu...
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-86409)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS max-age
values that exceeded calendar time structure bounds. An attacker could
possibly use this issue to cause a denial of service or data loss. This
issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)
Joshua Rogers discovered that libcurl had a use-after-free vulnerability
in the FTP wildcard matching code. An attacker could possibly use this
issue to cause curl to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 24.04 LTS noble | curl – 8.5.0-2ubuntu10.16 | ||
| libcurl3t64-gnutls – 8.5.0-2ubuntu10.16 | |||
| libcurl4-gnutls-dev – 8.5.0-2ubuntu10.16 | |||
| libcurl4-openssl-dev – 8.5.0-2ubuntu10.16 | |||
| libcurl4t64 – 8.5.0-2ubuntu10.16 | |||
| 22.04 LTS jammy | curl – 7.81.0-1ubuntu1.30 | ||
| libcurl3-gnutls – 7.81.0-1ubuntu1.30 | |||
| libcurl3-nss – 7.81.0-1ubuntu1.30 | |||
| libcurl4 – 7.81.0-1ubuntu1.30 | |||
| libcurl4-gnutls-dev – 7.81.0-1ubuntu1.30 | |||
| libcurl4-nss-dev – 7.81.0-1ubuntu1.30 | |||
| libcurl4-openssl-dev – 7.81.0-1ubuntu1.30 | |||
| 20.04 LTS focal | curl – 7.68.0-1ubuntu2.25+esm10 | ||
| libcurl3-gnutls – 7.68.0-1ubuntu2.25+esm10 | |||
| libcurl3-nss – 7.68.0-1ubuntu2.25+esm10 | |||
| libcurl4 – 7.68.0-1ubuntu2.25+esm10 | |||
| libcurl4-gnutls-dev – 7.68.0-1ubuntu2.25+esm10 | |||
| libcurl4-nss-dev – 7.68.0-1ubuntu2.25+esm10 | |||
| libcurl4-openssl-dev – 7.68.0-1ubuntu2.25+esm10 | |||
| 18.04 LTS bionic | curl – 7.58.0-2ubuntu3.24+esm15 | ||
| libcurl3-gnutls – 7.58.0-2ubuntu3.24+esm15 | |||
| libcurl3-nss – 7.58.0-2ubuntu3.24+esm15 | |||
| libcurl4 – 7.58.0-2ubuntu3.24+esm15 | |||
| libcurl4-gnutls-dev – 7.58.0-2ubuntu3.24+esm15 | |||
| libcurl4-nss-dev – 7.58.0-2ubuntu3.24+esm15 | |||
| libcurl4-openssl-dev – 7.58.0-2ubuntu3.24+esm15 | |||
| 16.04 LTS xenial | curl – 7.47.0-1ubuntu2.19+esm21 | ||
| libcurl3 – 7.47.0-1ubuntu2.19+esm21 | |||
| libcurl3-gnutls – 7.47.0-1ubuntu2.19+esm21 | |||
| libcurl3-nss – 7.47.0-1ubuntu2.19+esm21 | |||
| libcurl4-gnutls-dev – 7.47.0-1ubuntu2.19+esm21 | |||
| libcurl4-nss-dev – 7.47.0-1ubuntu2.19+esm21 | |||
| libcurl4-openssl-dev – 7.47.0-1ubuntu2.19+esm21 | |||
| 14.04 LTS trusty | curl – 7.35.0-1ubuntu2.20+esm24 | ||
| libcurl3 – 7.35.0-1ubuntu2.20+esm24 | |||
| libcurl3-gnutls – 7.35.0-1ubuntu2.20+esm24 | |||
| libcurl3-nss – 7.35.0-1ubuntu2.20+esm24 | |||
| libcurl4-gnutls-dev – 7.35.0-1ubuntu2.20+esm24 | |||
| libcurl4-nss-dev – 7.35.0-1ubuntu2.20+esm24 | |||
| libcurl4-openssl-dev – 7.35.0-1ubuntu2.20+esm24 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.