Ubuntu patches three curl flaws, one of which defeats peer validation over LDAP
Victoria Shinder1 min readCanonical has published USN-8820-1, which fixes three separate issues in curl. The first, reported by Eunsoo Kim, is a fault in how curl negotiates SASL for LDAP authentication: in certain circumstances an attacker positioned between the two endpoints can use it to bypass peer validation. That one is scoped to Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
The second, from Stephan Zeisberg, concerns HTTP/2 server push streams when a connection is shared between handles; a remote attacker can use it to crash curl, producing a denial of service. The third, from Stanislav Fort, is a lifetime error in pooled TLS connections when the multi interface is in use.
What it means
The middle issue is a crash and the last is a resource-handling bug, but the first is a different category. Peer validation is the single check that makes a TLS-protected LDAP bind worth doing at all; a way around it turns an authenticated directory lookup into an unauthenticated one without anything visibly failing. Nothing logs an error, because from the client's point of view the negotiation succeeded.
The practical difficulty is that curl is rarely a decision anyone remembers making. It sits inside container images, build steps, health checks and language bindings, and the version in use is whatever the base image shipped. So the question worth asking is not whether curl is patched on the hosts you administer, but which of your images were built before today and are still being pulled by name. A tag that does not move does not pick up a security update.