Ubuntu patches 22 curl vulnerabilities including high-severity RCE flaw

The curl project disclosed 22 security vulnerabilities on October 14, 2026, after coordinating under embargo with downstream distributors including Ubuntu. One vulnerability, CVE-2026-92392, is rated HIGH with a CVSS 3.1 score of 8.1 and enables remote code execution on Ubuntu 26.04 LTS. The remaining 21 vulnerabilities are rated low or medium severity and affect both the curl command-line tool and libcurl library across all supported Ubuntu releases. Ubuntu has issued patches via USN-8927-1 and USN-8932-1.

Vulnerability breakdown and affected releases

• CVE-2026-92392: use-after-free vulnerability allowing remote code execution; CVSS 3.1 score 8.1 (HIGH); only affects Ubuntu 26.04 LTS (curl 8.18.0-1ubuntu2.8); exploitation requires a malicious server and complex conditions
• CVE-2026-92388: also use-after-free, but rated low severity; affects only libcurl FTP usage, not the curl CLI tool
• Other 20 CVEs: credential leaks to wrong connections (including Kerberos tickets) via multiple protocols and proxies; TFTP and IMAP state machine issues leading to DoS or information disclosure; HTTP cookie jar wipe/truncation; HSTS expiration and durability problems; SSH host key checking flaws; GnuTLS data leak; memory exhaustion DoS; two TLS backend issues not present in Ubuntu builds
• Affected Ubuntu releases: Trusty 14.04 ESM, Xenial 16.04 ESM, Bionic 18.04 ESM, Focal 20.04 ESM, Jammy 22.04 LTS, Noble 24.04 LTS, Resolute 26.04 LTS — all with fixed packages available

Why it matters

curl and libcurl are among the most widely deployed open-source libraries, embedded in countless applications, containers, and IoT devices. The coordinated disclosure and rapid Ubuntu patching reduces exposure, but systems without automatic updates or running older Ubuntu versions without ESM remain at risk. The high-severity RCE being limited to 26.04 LTS narrows immediate impact, though the credential-leak class of vulnerabilities affects broader deployment patterns.