curl regression
Affects curlSource GCVE Database
Mentioned vulnerabilities
Rated by Threat Radar
- Patch
- Available – fixed in 7.35.0-1ubuntu2.20+esm23
Data as of 29 Sep 2026, 04:51 UTC
What to do
Upgrade the Ubuntu curl package to 7.35.0-1ubuntu2.20+esm23.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu Pro 14.04 LTScurlpkg:deb/ubuntu/curl?arch=source&distro=esm-infra-legacy/trustyOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
An official fix is available in update USN-8487-2. Users should apply this update promptly to fully remediate the vulnerabilities, including the incomplete fix for CVE-2026-8927. No additional mitigation actions are required beyond applying the vendor-provided patch.
Description
Multiple vulnerabilities in curl affecting various Ubuntu LTS and interim releases were addressed in update USN-8487-2. These include issues with connection reuse during STARTTLS upgrades, incorrect connection reuse for Negotiate authentication, improper cookie parsing, double-free leading to potential code execution, .netrc password selection errors, proxy authentication state leaks, use-after-free in event callbacks, early TLS data transmission without certificate verification, and SSH host key type mismatches. The update fixes an incomplete prior patch for CVE-2026-8927. These issues could allow remote attackers to cause denial of service, access sensitive information, or impersonate trusted servers.