Multiple security vulnerabilities were identified in curl, including issues that could lead to information disclosure, denial of service, arbitrary code execution, and man-in-the-middle attacks. These vulnerabilities affect various curl features such as WebSocket handling, AWS SigV4 authentication, SSH host verification, cookie handling, HTTP proxy authentication, HSTS processing, IMAP command injection, FTP wildcard matching, TFTP transfer direction validation, file overwrite protection, MIME structure processing, and HTTP/2 upload handling. The vulnerabilities were fixed in Ubuntu 26.10 package version 8.20.0-2ubuntu11.1.