Summary
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-86409)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS max-age
values that exceeded calendar time structure bounds. An attacker could
possibly use this issue to cause a denial of service or data loss. This
issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)
Joshua Rogers discovered that libcurl had a use-after-free vulnerability
in the FTP wildcard matching code. An attacker could possibly use this
issue to cause curl to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | curl | 7.81.0-1ubuntu1.30 |
| Ubuntu · 24.04 LTS 24.04:LTS | curl | 8.5.0-2ubuntu10.16 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | curl | 7.35.0-1ubuntu2.20+esm24 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | curl | 7.47.0-1ubuntu2.19+esm21 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | curl | 7.58.0-2ubuntu3.24+esm15 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | curl | 7.68.0-1ubuntu2.25+esm10 |
Vulnerabilities 9
-
Critical 9.1
leaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:…
-
Critical 9.1
FTP wildcard write callback mixup
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of …
-
High 8.1
stale SigV4 headers sent unintended
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking sta…
-
High 8.1
HSTS cache import drops longer-lived child
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading …
-
High 8.1
HSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds cale…
-
High 8.1
IMAP APPEND plus CRLF conversion command injection
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted an…
-
High 8.1
TFTP direction confusion
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that fo…
-
High 7.5
curl_mime_free stack overflow by recursion
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traver…
-
High 7.5
password leak in CURLINFO_EFFECTIVE_URL
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
References
-
report
https://ubuntu.com/security/CVE-2026-86409
-
report
https://ubuntu.com/security/CVE-2026-86414
-
report
https://ubuntu.com/security/CVE-2026-87862
-
report
https://ubuntu.com/security/CVE-2026-87863
-
report
https://ubuntu.com/security/CVE-2026-87864
-
report
https://ubuntu.com/security/CVE-2026-92388
-
report
https://ubuntu.com/security/CVE-2026-92389
-
report
https://ubuntu.com/security/CVE-2026-92391
-
report
https://ubuntu.com/security/CVE-2026-94266