Skip to content
OpenAdvisories
High USN-8670-3 1 CVE

curl vulnerability

Published Sep 8, 2026 · Updated Sep 10, 2026

Ecosystem: Ubuntu

Summary

USN-8670-1 fixed a vulnerability in curl. This update provides the
corresponding update for Ubuntu 26.04 LTS.

Original advisory details:

Joshua Rogers discovered that curl incorrectly handled reusing
connections when client certificate settings changed. This could result
in the wrong client certificates being used, contrary to expectations.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 26.04 LTS 26.04:LTS curl 8.18.0-1ubuntu2.5

Vulnerabilities 1

  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-8932