Summary
Zhicheng Chen discovered that curl could incorrectly reuse the wrong
connection for Negotiate-authenticated HTTP or HTTPS requests. This could
result in the use of credentials from a different connection, contrary to
expectations. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-1965)
It was discovered that curl incorrectly leaked OAuth2 bearer tokens when
following a redirect. This could result in tokens being sent to the wrong
host, contrary to expectations. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-3783)
Muhamad Arga Reksapati discovered that curl incorrectly reused existing
HTTP proxy connections even if the request used different credentials. This
could result in the use of incorrect credentials, contrary to expectations.
(CVE-2026-3784)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | curl | 7.58.0-2ubuntu3.24+esm8 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | curl | 7.68.0-1ubuntu2.25+esm3 |
Vulnerabilities 3
-
Medium 6.5
bad reuse of HTTP Negotiate connection
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When …
-
Medium 6.5
wrong proxy connection reuse with credentials
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.
-
Medium 5.3
token leak with redirect and netrc
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has informa…