Summary
Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for
LDAP authentication in certain circumstances. A machine-in-the-middle
attacker could possibly use this issue to bypass peer validation. This
issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-13608)
Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server
Push streams when sharing connections between handles. A remote attacker
could possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-18924)
Stanislav Fort discovered that curl incorrectly managed the lifetime of
pooled TLS connections when using the multi interface. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service, or execute arbitrary code. This issue only affected Ubuntu 26.04
LTS. (CVE-2026-80229)
Stanislav Fort discovered that curl did not properly enforce public key
pinning when certificate verification was disabled in certain
circumstances. A remote attacker could possibly use this issue to bypass
pinning checks and cause curl to accept connections that should have been
rejected. (CVE-2026-80230)
Stanislav Fort discovered that curl incorrectly handled the Secure
attribute of cookies in certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-80255)
Stanislav Fort discovered that curl did not properly enforce Public
Suffix List boundaries when handling cookies in certain circumstances. A
remote attacker could possibly use this issue to cause cookies to be sent
to unrelated domains, resulting in sensitive information being exposed.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)
Ady Elouej discovered that curl did not clear proxy authentication state
between requests when reusing a handle with environment-variable proxy
configuration. A remote attacker could possibly use this issue to obtain
sensitive credentials. This issue was previously fixed in USN-8487-1, but
that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | curl | 7.81.0-1ubuntu1.29 |
| Ubuntu · 24.04 LTS 24.04:LTS | curl | 8.5.0-2ubuntu10.15 |
| Ubuntu · 26.04 LTS 26.04:LTS | curl | 8.18.0-1ubuntu2.7 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | curl | 7.47.0-1ubuntu2.19+esm20 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | curl | 7.58.0-2ubuntu3.24+esm14 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | curl | 7.68.0-1ubuntu2.25+esm9 |
Vulnerabilities 8
-
Critical 9.1
HTTP/2 server push UAF
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
-
Critical 9.1
env-set cross-proxy Digest auth state leak
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…
-
High 8.2
domain-scoped PSL domain cookie
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co…
-
High 7.5
OpenSSL provider use-after-free
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL…
-
High 7.5
OpenSSL pinning bypass
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented …
-
High 7.5
secure cookie attribute bypass with tab
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on…
-
High 7.4
OpenLDAP SASL authentication bypass
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut …
-
High 7.3
UAF after pause in socket callback
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
References
-
report
https://ubuntu.com/security/CVE-2026-8927
-
report
https://ubuntu.com/security/CVE-2026-9080
-
report
https://ubuntu.com/security/CVE-2026-13608
-
report
https://ubuntu.com/security/CVE-2026-18924
-
report
https://ubuntu.com/security/CVE-2026-80229
-
report
https://ubuntu.com/security/CVE-2026-80230
-
report
https://ubuntu.com/security/CVE-2026-80255
-
report
https://ubuntu.com/security/CVE-2026-82209