Multiple curl Vulnerabilities Expose Ubuntu Systems to Credential Theft and DoS
Several high-severity flaws in curl affect Ubuntu 22.04 and 24.04 LTS, including credential exposure and denial of service.
TL;DR
- Five CVEs impact curl’s handling of AWS SigV4, HTTP proxies, HSTS, cookies, and SSH redirects.
- Attackers may steal credentials, bypass encryption, or cause denial of service.
- Affects Ubuntu 22.04 LTS and 24.04 LTS; immediate update recommended.
- Includes out-of-bounds read in WebSocket path when built with GnuTLS.
- One flaw allows unintended source addresses during connection reuse.
Security researchers have uncovered multiple vulnerabilities in the widely-used curl utility affecting Ubuntu 22.04 LTS and 24.04 LTS. These issues range from improper credential handling to potential denial of service, putting enterprise applications at risk. Organizations using curl for API interactions, file transfers, or backend integrations should prioritize patching.
The flaws were primarily identified by researcher Stanislav Fort and include weaknesses in authentication state management, proxy behavior, and secure connection enforcement. One vulnerability impacts WebSocket functionality when compiled with GnuTLS, while another affects how curl handles network interface binding during connection reuse.
Authentication and Proxy Handling Flaws
- CVE-2026-86409: curl fails to clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 is set to NULL, potentially leaking credentials.
- CVE-2026-86414 / CVE-2026-86410: HTTP proxies can trick curl into sending credentials to them or bypass SSH host verification during redirects to SFTP/SCP URLs.
- CVE-2026-107929: Incorrect interface binding during connection reuse may cause traffic to originate from unintended network interfaces.
HSTS, Cookie, and Memory Safety Issues
- CVE-2026-87862: Improper handling of HSTS entries allows attackers to downgrade connections to unencrypted HTTP.
- CVE-2026-87863: Malformed HSTS max-age values exceeding system limits may lead to denial of service or data loss.
- CVE-2026-86412: Corrupted cookie jar entries that cannot be reloaded may crash curl processes.
- CVE-2026-107928: Out-of-bounds read in WebSocket send path when curl is built with GnuTLS support may leak memory contents.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.