Summary
USN-8927-1 fixed vulnerabilities in curl. This update provides the
corresponding fixes for Ubuntu 26.10.
Original advisory details:
It was discovered that curl, when built with GnuTLS support, had an
out-of-bounds read in the WebSocket send path. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-107928)
Maksim discovered that curl did not correctly include the interface
binding in connection reuse decisions when CURLOPT_INTERFACE was used.
An attacker could possibly use this issue to cause connections to go
out from an unintended source address. (CVE-2026-107929)
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-86409)
Stanislav Fort discovered that the curl command line tool did not set
SSH host verification options when following redirects to SFTP or SCP
URLs. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-86410)
Stanislav Fort discovered that curl did not properly handle cookie jar
entries that could not be reloaded. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-86412)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS
max-age values that exceeded calendar time structure bounds. An
attacker could possibly use this issue to cause a denial of service or
data loss. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)
Bobbeh Rhino discovered that libcurl, when used with libssh2 and a
hashed known_hosts file, could misreport a host key mismatch as a
missing key. An attacker could possibly use this issue to perform
machine-in-the-middle attacks. (CVE-2026-87865)
Joshua Rogers discovered that curl did not properly handle long cookie
entries written to a Netscape cookie jar. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-92386)
Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP
server could cause libcurl to block indefinitely by omitting the final
control-response line. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-92387)
Joshua Rogers discovered that libcurl had a use-after-free
vulnerability in the FTP wildcard matching code. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl did not properly enforce its file
overwrite protection when using --remote-header-name in certain
circumstances. An attacker could possibly use this issue to overwrite
local files. (CVE-2026-92390)
Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial
of service. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-94266)
Joshua Rogers discovered that libcurl had a use-after-free
vulnerability during HTTP/2 uploads when handling RST_STREAM responses
from the server. An attacker could possibly use this issue to cause
curl to crash, resulting in a denial of service, or execute arbitrary
code. (CVE-2026-92392)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.10 | curl | 8.20.0-2ubuntu11.1 |
Vulnerabilities 18
-
Critical 9.1
leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:…
-
Critical 9.1
FTP wildcard write callback mixup
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of …
-
High 8.1
info leak uploading over WebSockets with GnuTLS
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent **greater than the number of bytes it was gi…
-
High 8.1
local interface connection reuse mixup
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can sile…
-
High 8.1
stale SigV4 headers sent unintended
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking sta…
-
High 8.1
redirect to SFTP or SCP bypasses host verification
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
-
High 8.1
server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the …
-
High 8.1
HSTS cache import drops longer-lived child
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading …
-
High 8.1
HSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds cale…
-
High 8.1
IMAP APPEND plus CRLF conversion command injection
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted an…
-
High 8.1
server-set cookie aborts cookie jar load
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cooki…
-
High 8.1
never-ending loop via server response omission
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-ha…
-
High 8.1
TFTP direction confusion
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that fo…
-
High 8.1CVE-2026-92392 Public exploit
HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
-
High 7.5
-J no-clobber guarantee bypassed with 103 early hints
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` un…
-
High 7.5
curl_mime_free stack overflow by recursion
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…
-
High 7.5
password leak in CURLINFO_EFFECTIVE_URL
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
-
High 7.4
knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
References
-
report
https://ubuntu.com/security/CVE-2026-86409
-
report
https://ubuntu.com/security/CVE-2026-86410
-
report
https://ubuntu.com/security/CVE-2026-86412
-
report
https://ubuntu.com/security/CVE-2026-86414
-
report
https://ubuntu.com/security/CVE-2026-87862
-
report
https://ubuntu.com/security/CVE-2026-87863
-
report
https://ubuntu.com/security/CVE-2026-87864
-
report
https://ubuntu.com/security/CVE-2026-87865
-
report
https://ubuntu.com/security/CVE-2026-92386
-
report
https://ubuntu.com/security/CVE-2026-92387
-
report
https://ubuntu.com/security/CVE-2026-92388
-
report
https://ubuntu.com/security/CVE-2026-92389
-
report
https://ubuntu.com/security/CVE-2026-92390
-
report
https://ubuntu.com/security/CVE-2026-92391
-
report
https://ubuntu.com/security/CVE-2026-92392
-
report
https://ubuntu.com/security/CVE-2026-94266
-
report
https://ubuntu.com/security/CVE-2026-107928
-
report
https://ubuntu.com/security/CVE-2026-107929