curl Vulnerabilities Expose Ubuntu Systems to Credential Theft and DoS
Multiple high-severity flaws in curl affect various Ubuntu LTS versions, potentially leading to credential exposure, unauthorized access, and denial of service.
TL;DR
- Several curl vulnerabilities impact multiple Ubuntu LTS releases including 14.04, 16.04, 18.04, 20.04, 24.04, 25.04, and 25.10.
- Issues range from credential leakage during HTTP redirects to use-after-free bugs that could enable remote code execution.
- Administrators should update their systems immediately to mitigate risks of data theft and service disruption.
- Affected components include HTTP/2 stream handling, OCSP stapling responses, .netrc file usage, and connection reuse logic.
- The flaws were reported by security researchers including Harry Sintonen, Hiroki Kurosawa, Joshua Rogers, Quac Tran, and Osama Hamad.
Ubuntu has released security updates addressing multiple vulnerabilities in the widely used curl utility. These issues span several Long Term Support (LTS) versions and expose systems to risks such as credential disclosure, denial of service, and potential remote code execution. Organizations relying on curl for network operations within these Ubuntu environments should prioritize patching.
The flaws stem from improper handling of HTTP redirects, flawed connection reuse logic, unsafe memory cleanup in HTTP/2 streams, and incorrect processing of TLS certificate status information. Each vulnerability was independently discovered and responsibly reported by members of the security research community, highlighting the importance of ongoing scrutiny in open-source tools.
Authentication and Redirect Handling Flaws
- A flaw in how curl processes credentials during HTTP redirects when using .netrc files may allow attackers to steal authentication data (CVE-2024-11053).
- This issue affects Ubuntu 14.04 LTS, 16.04 LTS, and 18.04 LTS, requiring immediate attention from legacy system maintainers.
Memory Safety and Connection Reuse Risks
- A use-after-free condition in HTTP/2 stream handle cleanup can lead to denial of service or arbitrary code execution (CVE-2026-10536), affecting Ubuntu 24.04 LTS, 25.04, and 25.10.
- Improper OCSP stapling response validation exposes systems to information leakage in Ubuntu 16.04 LTS and 18.04 LTS (CVE-2024-8096).
- Connection reuse across different authentication contexts may leak credentials or permit unauthorized actions in Ubuntu 20.04 LTS (CVE-2026-5545).
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.