SB2026103120 - Ubuntu update for curl
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86409)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose an access-key identifier and a request-bound signature.
The vulnerability exists due to failure to disable SigV4 authentication in libcurl's SigV4 authentication handling when an application sets CURLOPT_AWS_SIGV4 to NULL and reuses the same easy handle while retaining CURLOPT_USERPWD credentials. A remote attacker can influence the destination URL of a subsequent request to disclose an access-key identifier and a request-bound signature.
The secret key is not transmitted. This flaw is not accessible through the curl command line tool.
2) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86414)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose origin credentials.
The vulnerability exists due to incorrect handling of origin authentication challenges in libcurl's HTTP proxy tunnel handling when processing responses to CONNECT requests. A remote attacker can return an HTTP 401 response with a WWW-Authenticate header instead of the expected HTTP 407 response with a Proxy-Authenticate header to disclose origin credentials.
Exploitation requires the client to use an attacker-controlled HTTP proxy. Exposed credentials can include a Basic authentication password or a Negotiate/Kerberos ticket.
3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87862)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain information sent over unencrypted HTTP.
The vulnerability exists due to incorrect discarding of longer-lived child HSTS entries in curl's HSTS cache import functionality when importing an includeSubDomains parent entry before a longer-lived child entry. A remote attacker can take advantage of the loss of HTTPS enforcement after the parent entry expires to obtain information sent over unencrypted HTTP.
4) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-87863)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to erase persisted HSTS cache entries.
The vulnerability exists due to improper handling of time serialization failures in HSTS cache persistence when saving entries received from an authenticated HTTPS origin. A remote user can supply an HSTS max-age value that the parser accepts but time serialization cannot process to erase persisted HSTS cache entries.
On 64-bit systems, extreme max-age values can produce expiry times within time integer limits but beyond calendar time structure bounds. Cache save errors are silently ignored during cleanup, allowing curl to exit successfully.
5) Command injection (CVE-ID: CVE-2026-87864)
CWE-ID: CWE-77 - Command injection
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject and execute IMAP commands within an authenticated session.
The vulnerability exists due to improper handling of a length parameter inconsistency in curl's IMAP APPEND implementation when processing uploads. A remote user can supply upload data whose line-ending conversion expands it beyond the advertised literal length to inject and execute IMAP commands within an authenticated session.
Exploitation requires CURLOPT_CRLF to be enabled.
6) Use-after-free (CVE-ID: CVE-2026-92388)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.
The vulnerability exists due to use-after-free and type confusion in libcurl's FTP wildcard write callback handling when reusing or cloning an easy handle after a failed FTP wildcard LIST operation. A remote attacker can supply server response bytes that are processed through the incorrectly retained internal listing parser to cause a denial of service and corrupt memory.
Exploitation requires CURLOPT_FTP_WILDCARD to be enabled. The use-after-free read occurs when the original handle is freed before a transfer executes on its duplicate. Type confusion occurs when the application changes CURLOPT_WRITEDATA without also changing CURLOPT_WRITEFUNCTION. The curl command-line tool is not affected.
7) Information disclosure (CVE-ID: CVE-2026-92389)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper validation of state transitions against the requested transfer direction in libcurl's TFTP state machine when handling opening server responses to download requests. A remote attacker can send a specially crafted server response that forces the client into transmit mode to disclose sensitive information.
Data is consumed from the handle's persistent CURLOPT_READDATA pointer, which may retain data from unrelated prior operations, such as an HTTP POST request executed on a reused handle. The curl command-line tool is not affected.
8) Uncontrolled Recursion (CVE-ID: CVE-2026-92391)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in libcurl's curl_mime_free function when traversing deeply nested multipart MIME structures during cleanup. A local user can construct a deeply nested multipart MIME structure through the public API to cause a denial of service.
Triggering the flaw requires thousands of nested MIME parts, with the exact threshold depending on the system and configuration. The curl command line tool is not affected.
9) Insufficiently protected credentials (CVE-ID: CVE-2026-94266)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain sensitive credentials.
The vulnerability exists due to insufficient protection of credentials in the curl_easy_getinfo CURLINFO_EFFECTIVE_URL option when retrieving credentials from a .netrc file. A local user can read credentials exposed in the returned effective URL to obtain sensitive credentials.
Credentials can appear even when neither the original URL nor the redirected URL contains them. The curl command-line option --write-out '%{url_effective}' exposes the same information.
Remediation
Install update from vendor's website.