Home / mailings [USN-8525-1] curl vulnerabilities
Posted on 09 July 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8525-1
July 09, 2026
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Harry Sintonen discovered that curl incorrectly handled credentials when
following HTTP redirects in conjunction with .netrc files. An attacker
could possibly use this issue to obtain sensitive information. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-11053)
Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling
responses. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2024-8096)
Joshua Rogers discovered that curl had a use-after-free vulnerability when
resetting and cleaning up HTTP/2 stream handles. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2026-10536)
Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections
when switching authentication methods to the same host. An attacker could
possibly use this issue to obtain sensitive information or perform
unauthorized actions. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-5545)
Osama Hamad discovered that curl incorrectly reused SMB connections when
the target share differed between transfers. An attacker could possibly use
this issue to obtain sensitive information. This issue only affected Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773)
Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest
proxy authentication credentials to a different proxy host. An attacker
could possibly use this issue to obtain sensitive information. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168)
It was discovered that curl incorrectly skipped SSH host verification
options when using schemeless URLs with --proto-default. An attacker could
possibly use this issue to perform machine-in-the-middle attacks. This
issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-12064)
It was discovered that curl did not enforce an upper bound on memory
allocated for unacknowledged WebSocket PING frames. A remote attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.10. (CVE-2026-11586)
It was discovered that curl could stall indefinitely when a malicious
HTTP/3 server sent a continuous stream of empty UDP datagrams. A remote
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 25.10. (CVE-2026-11352)
It was discovered that curl could incorrectly continue trusting a native
platform CA store after an application switched the handle to use custom CA
material. An attacker could possibly use this issue to obtain sensitive
information. This issue only affected Ubuntu 25.10. (CVE-2026-11564)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
curl 8.18.0-1ubuntu2.3
libcurl3t64-gnutls 8.18.0-1ubuntu2.3
libcurl4-gnutls-dev 8.18.0-1ubuntu2.3
libcurl4-openssl-dev 8.18.0-1ubuntu2.3
libcurl4t64 8.18.0-1ubuntu2.3
Ubuntu 25.10
curl 8.14.1-2ubuntu1.5
libcurl3t64-gnutls 8.14.1-2ubuntu1.5
libcurl4-gnutls-dev 8.14.1-2ubuntu1.5
libcurl4-openssl-dev 8.14.1-2ubuntu1.5
libcurl4t64 8.14.1-2ubuntu1.5
Ubuntu 24.04 LTS
curl 8.5.0-2ubuntu10.11
libcurl3t64-gnutls 8.5.0-2ubuntu10.11
libcurl4-gnutls-dev 8.5.0-2ubuntu10.11
libcurl4-openssl-dev 8.5.0-2ubuntu10.11
libcurl4t64 8.5.0-2ubuntu10.11
Ubuntu 20.04 LTS
curl 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl3-gnutls 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl3-nss 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl4 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl4-nss-dev 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
libcurl4-openssl-dev 7.68.0-1ubuntu2.25+esm5
Available with Ubuntu Pro
Ubuntu 18.04 LTS
curl 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl3-gnutls 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl3-nss 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl4 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl4-nss-dev 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
libcurl4-openssl-dev 7.58.0-2ubuntu3.24+esm10
Available with Ubuntu Pro
Ubuntu 16.04 LTS
curl 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl3 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl3-gnutls 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl3-nss 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl4-nss-dev 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
libcurl4-openssl-dev 7.47.0-1ubuntu2.19+esm17
Available with Ubuntu Pro
Ubuntu 14.04 LTS
curl 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl3 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl3-gnutls 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl3-nss 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl4-gnutls-dev 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl4-nss-dev 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
libcurl4-openssl-dev 7.35.0-1ubuntu2.20+esm21
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8525-1
CVE-2024-11053, CVE-2024-8096, CVE-2026-10536, CVE-2026-11352,
CVE-2026-11564, CVE-2026-11586, CVE-2026-12064, CVE-2026-5545,
CVE-2026-5773, CVE-2026-7168
Package Information:
https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3
https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5
https://launchpad.net/ubuntu/+source/curl/8.5.0-2ubuntu10.11
--===============5070602817409010313==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
