The USN-8487-2 update for curl addresses multiple security vulnerabilities originally fixed in USN-8487-1 but incompletely patched for CVE-2026-8927. Vulnerabilities include improper reuse of live connections during STARTTLS upgrades (CVE-2026-8286), incorrect reuse of connections for Negotiate authentication across different services (CVE-2026-8458), flawed cookie parsing allowing setting cookies for unrelated domains (CVE-2026-8924), double-free of GSASL context causing potential denial of service or code execution (CVE-2026-8925), incorrect password selection from .netrc files (CVE-2026-8926), failure to clear proxy authentication state leading to credential exposure (CVE-2026-8927 and CVE-2026-9079), use-after-free in event-based socket callbacks (CVE-2026-9080), sending early TLS data before certificate verification (CVE-2026-9545), and improper rejection of SSH host key type mismatches enabling impersonation (CVE-2026-9547). These vulnerabilities affect multiple Ubuntu versions including 16.04 LTS through 26.04 LTS and some interim releases. The update fully resolves these issues.

Remote attackers could exploit these vulnerabilities to cause denial of service, execute arbitrary code, access sensitive credentials, impersonate trusted servers, or cause curl to use unintended TLS configurations. Some issues allow cross-service credential leakage or cookie setting for unrelated domains, potentially compromising security boundaries. The vulnerabilities affect multiple Ubuntu LTS and interim releases, impacting systems using vulnerable curl versions.

An official fix is available in update USN-8487-2. Users should apply this update promptly to fully remediate the vulnerabilities, including the incomplete fix for CVE-2026-8927. No additional mitigation actions are required beyond applying the vendor-provided patch.