Skip to content
OpenAdvisories
High USN-8670-2 1 CVE

curl vulnerability

Published Aug 25, 2026 · Updated Aug 26, 2026

Ecosystem: Ubuntu

Summary

USN-8670-1 fixed a vulnerability in curl. This update provides the
corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS.

Original advisory details:

Joshua Rogers discovered that curl incorrectly handled reusing
connections when client certificate settings changed. This could result
in the wrong client certificates being used, contrary to expectations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS curl 7.81.0-1ubuntu1.27
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS curl 7.58.0-2ubuntu3.24+esm12
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS curl 7.68.0-1ubuntu2.25+esm7

Vulnerabilities 1

  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-8932