curl vulnerabilities
It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929) Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409) Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410) Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when a
- Products
- curl
- Affected versions
- 8.14.1-2ubuntu1, 8.17.0-1ubuntu1, 8.18.0-1ubuntu1, 8.18.0-1ubuntu2, 8.18.0-1ubuntu2.1, 8.18.0-1ubuntu2.2, 8.18.0-1ubuntu2.3, 8.18.0-1ubuntu2.4, 8.18.0-1ubuntu2.5, 8.18.0-1ubuntu2.7
- Fixed versions
- 8.18.0-1ubuntu2.8
- CVEs
- CVE-2026-107928, CVE-2026-107929, CVE-2026-86409, CVE-2026-86410, CVE-2026-86412, CVE-2026-86414, CVE-2026-87862, CVE-2026-87863, CVE-2026-87864, CVE-2026-87865, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-92392, CVE-2026-94266
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:36 UTC · Revision 1
Source evidence
It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929) Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409) Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410) Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when a
osv:USN-8927-1
curl
Fixed versions: 8.18.0-1ubuntu2.8
Complete source record
{
"id": "cb781494550265fe0650e25d99b273b6c2ca08365d8276872263e70ec8ed6645",
"url": "https://osv.dev/vulnerability/USN-8927-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "curl vulnerabilities",
"summary": "It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929) Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409) Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410) Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when a",
"evidence": "osv:USN-8927-1",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.18.0-1ubuntu2.8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "8.14.1-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "8.17.0-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.1",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.2",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.3",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.4",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.5",
"evidence": "/affected/0/versions"
},
{
"value": "8.18.0-1ubuntu2.7",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "USN-8927-1",
"aliases": [
"USN-8927-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.18.0-1ubuntu2.8"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/ubuntu/curl?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"8.14.1-2ubuntu1",
"8.17.0-1ubuntu1",
"8.18.0-1ubuntu1",
"8.18.0-1ubuntu2",
"8.18.0-1ubuntu2.1",
"8.18.0-1ubuntu2.2",
"8.18.0-1ubuntu2.3",
"8.18.0-1ubuntu2.4",
"8.18.0-1ubuntu2.5",
"8.18.0-1ubuntu2.7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8927-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-86409",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-86410",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-86412",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-86414",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-87862",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-87863",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-87864",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-87865",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92386",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92387",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92388",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92389",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92390",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92391",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-92392",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "high"
}
]
},
{
"id": "CVE-2026-94266",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-107928",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-107929",
"severity": [
{
"type": "Ubuntu",
"score": "low"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "curl",
"binary_version": "8.18.0-1ubuntu2.8"
},
{
"binary_name": "libcurl3t64-gnutls",
"binary_version": "8.18.0-1ubuntu2.8"
},
{
"binary_name": "libcurl4t64",
"binary_version": "8.18.0-1ubuntu2.8"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-17T13:12:59.609211919Z",
"provider": "osv",
"upstream": [
"CVE-2026-107928",
"CVE-2026-107929",
"CVE-2026-86409",
"CVE-2026-86410",
"CVE-2026-86412",
"CVE-2026-86414",
"CVE-2026-87862",
"CVE-2026-87863",
"CVE-2026-87864",
"CVE-2026-87865",
"CVE-2026-92386",
"CVE-2026-92387",
"CVE-2026-92388",
"CVE-2026-92389",
"CVE-2026-92390",
"CVE-2026-92391",
"CVE-2026-92392",
"CVE-2026-94266",
"UBUNTU-CVE-2026-107928",
"UBUNTU-CVE-2026-107929",
"UBUNTU-CVE-2026-86409",
"UBUNTU-CVE-2026-86410",
"UBUNTU-CVE-2026-86412",
"UBUNTU-CVE-2026-86414",
"UBUNTU-CVE-2026-87862",
"UBUNTU-CVE-2026-87863",
"UBUNTU-CVE-2026-87864",
"UBUNTU-CVE-2026-87865",
"UBUNTU-CVE-2026-92386",
"UBUNTU-CVE-2026-92387",
"UBUNTU-CVE-2026-92388",
"UBUNTU-CVE-2026-92389",
"UBUNTU-CVE-2026-92390",
"UBUNTU-CVE-2026-92391",
"UBUNTU-CVE-2026-92392",
"UBUNTU-CVE-2026-94266"
],
"references": [
"https://ubuntu.com/security/notices/USN-8927-1",
"https://ubuntu.com/security/CVE-2026-86409",
"https://ubuntu.com/security/CVE-2026-86410",
"https://ubuntu.com/security/CVE-2026-86412",
"https://ubuntu.com/security/CVE-2026-86414",
"https://ubuntu.com/security/CVE-2026-87862",
"https://ubuntu.com/security/CVE-2026-87863",
"https://ubuntu.com/security/CVE-2026-87864",
"https://ubuntu.com/security/CVE-2026-87865",
"https://ubuntu.com/security/CVE-2026-92386",
"https://ubuntu.com/security/CVE-2026-92387",
"https://ubuntu.com/security/CVE-2026-92388",
"https://ubuntu.com/security/CVE-2026-92389",
"https://ubuntu.com/security/CVE-2026-92390",
"https://ubuntu.com/security/CVE-2026-92391",
"https://ubuntu.com/security/CVE-2026-92392",
"https://ubuntu.com/security/CVE-2026-94266",
"https://ubuntu.com/security/CVE-2026-107928",
"https://ubuntu.com/security/CVE-2026-107929"
]
},
"related_cves": [
{
"value": "CVE-2026-107928",
"evidence": "/upstream"
},
{
"value": "CVE-2026-107929",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86409",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86410",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86412",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86414",
"evidence": "/upstream"
},
{
"value": "CVE-2026-87862",
"evidence": "/upstream"
},
{
"value": "CVE-2026-87863",
"evidence": "/upstream"
},
{
"value": "CVE-2026-87864",
"evidence": "/upstream"
},
{
"value": "CVE-2026-87865",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92386",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92387",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92388",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92389",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92390",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92391",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92392",
"evidence": "/upstream"
},
{
"value": "CVE-2026-94266",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 361843,
"published_at": "2026-10-14T11:58:06+00:00"
}