Dev News Daily ENDE

Ubuntu USN-8932-1 fixes nine curl flaws, from proxy credential leaks to an FTP use-after-free

Victoria Shinder2 min read

Canonical published Ubuntu Security Notice USN-8932-1 on 14 October 2026, fixing nine vulnerabilities in curl and libcurl. The update covers Ubuntu 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, 16.04 LTS and 14.04 LTS; several of the issues affect only the newer releases.

Credentials and authentication state. Two of the flaws can expose secrets. A malicious HTTP proxy could get libcurl to hand it the user's credentials by replying to the tunnel request with an authentication challenge libcurl did not expect (CVE-2026-86414). Resetting CURLOPT_AWS_SIGV4 to NULL did not wipe the previously set SigV4 signing state (CVE-2026-86409, Ubuntu 22.04 and 24.04 only). A third issue concerns .netrc: libcurl could expose credentials taken from that file in the URL returned by CURLINFO_EFFECTIVE_URL (CVE-2026-94266, Ubuntu 20.04, 22.04 and 24.04).

HSTS. If an HSTS file listed a parent domain with includeSubDomains ahead of a subdomain entry that expires later, curl could end up connecting over plain HTTP (CVE-2026-87862, 22.04 and 24.04). Separately, HSTS max-age values beyond the bounds of the calendar time structure could cause a denial of service or data loss (CVE-2026-87863, 24.04 only).

Ubuntu USN-8932-1 fixes nine curl flaws, from proxy credential leaks to an FTP use-after-free
Ubuntu USN-8932-1 fixes nine curl flaws, from proxy credential leaks to an FTP use-after-free — Dev News Daily

Protocol handling. With CURLOPT_CRLF enabled, overflow bytes in IMAP APPEND commands could be interpreted as pipelined commands, letting an authenticated attacker inject IMAP commands (CVE-2026-87864). libcurl had a use-after-free in its FTP wildcard matching code, which Canonical says could crash curl or allow arbitrary code execution (CVE-2026-92388). The TFTP state machine did not validate transfer directions, so a malicious server could force the client into transmit mode (CVE-2026-92389), and deeply nested MIME structures could overflow the stack (CVE-2026-92391, 18.04 to 24.04).

Five of the issues were reported by Stanislav Fort and four by Joshua Rogers, according to the notice.

What to install. Canonical says a standard system update applies the fixes. On 24.04 LTS the fixed package version is 8.5.0-2ubuntu10.16; on 22.04 LTS it is 7.81.0-1ubuntu1.30. The notice lists the versions for the other releases.

Source: Ubuntu, "USN-8932-1: curl vulnerabilities" — https://ubuntu.com/security/notices/USN-8932-1

Primary source
Ubuntu Security Notices
https://ubuntu.com/security/notices/USN-8932-1
Written by Victoria Shinder.