SB2026093019 - Ubuntu update for curl
Published: September 30, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2026-13608)
CWE-ID: CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass LDAP server authentication.
The vulnerability exists due to improper restriction of communication channel to intended endpoints in the libcurl SASL negotiation for LDAP authentication when processing an incomplete OpenLDAP SASL handshake sequence. A remote attacker can inject a premature or shortcut response to bypass LDAP server authentication.
The issue only occurs when the OpenLDAP backend is used, and LDAPS is not affected.
2) Use-after-free (CVE-ID: CVE-2026-18924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to use-after-free in libcurl HTTP/2 server push stream handling when processing an HTTPS HTTP/2 server push on a shared connection. A remote attacker can send a server push response sequence to trigger a use-after-free.
The issue affects libcurl only and requires HTTP/2 server push to be enabled and accepted by the application, along with connection sharing.
3) Use-after-free (CVE-ID: CVE-2026-80229)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to use-after-free in libcurl multi interface connection reuse handling when performing transfers over pooled TLS connections with OpenSSL 3 providers. A remote user can trigger premature easy handle destruction during connection reuse to cause a denial of service.
This affects libcurl built with OpenSSL 3+ provider configurations and also impacts the curl command line tool.
4) Improper Certificate Validation (CVE-ID: CVE-2026-80230)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass public key pinning.
The vulnerability exists due to improper certificate validation in libcurl and the curl command line tool when establishing TLS connections with CURLOPT_PINNEDPUBLICKEY configured and peer and host verification disabled. A remote attacker can present a connection without a server certificate to bypass public key pinning.
This issue is present only when curl is built with OpenSSL or a fork such as BoringSSL, AWS-LC, LibreSSL, or QuicTLS, and the insecure configuration also permits certificate-less connections.
5) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-80255)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie attribute handling in the Set-Cookie header processing logic when parsing a Set-Cookie header that uses a tab immediately before the Secure attribute. A remote attacker can send a specially crafted Set-Cookie header to disclose sensitive information.
The issue can cause a cookie to be stored without its Secure flag and then be sent over plaintext HTTP on subsequent requests to the same host.
6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-82209)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.
Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.
7) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-8927)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate the client to another proxy.
The vulnerability exists due to authentication bypass by capture-replay in libcurl proxy authentication state handling when reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration. A remote user can receive a leaked Proxy-Authorization header on a subsequent request to impersonate the client to another proxy.
The issue affects libcurl and does not affect the curl command line tool.
8) Use-after-free (CVE-ID: CVE-2026-9080)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the libcurl socket callback handling when calling curl_easy_pause() within the CURLMOPT_SOCKETFUNCTION callback. A local user can invoke the affected callback sequence to cause a denial of service.
This issue affects libcurl and does not affect the curl command line tool.
Remediation
Install update from vendor's website.