# Ubuntu patches multiple curl and libcurl vulnerabilities

> **Key takeaway:** Multiple vulnerabilities in curl and libcurl affecting credential security, HSTS handling, and denial of service have been addressed in Ubuntu security updates.

**Published:** 2026-10-14T19:26:26+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-multiple-curl-and-libcurl-vulnerabilities.html 

## Summary
Ubuntu has released security updates to address several vulnerabilities in curl and libcurl. The flaws range from potential credential exposure via HTTP proxies and .netrc files to denial of service risks through stack overflows and use-after-free errors. Fixes are available for various Ubuntu LTS releases, with some older versions requiring Ubuntu Pro.

## Vulnerability details
- **Credential exposure**: Vulnerabilities in AWS SigV4 state clearing (CVE-2026-86409), HTTP proxy CONNECT requests (CVE-2026-86414), and .netrc file handling (CVE-2026-94266).
- **HSTS issues**: Improper handling of includeSubDomains (CVE-2026-87862) and max-age values (CVE-2026-87863) can lead to unencrypted connections or DoS.
- **Memory and execution errors**: A use-after-free in FTP wildcard matching (CVE-2026-92388), a stack overflow in MIME processing (CVE-2026-92391), and IMAP command injection (CVE-2026-87864).
- **Protocol flaws**: TFTP state machine validation error (CVE-2026-92389).

## Why it matters
Since curl and libcurl are fundamental components for network communication in almost all Linux environments, these patches are critical for maintaining system security and data integrity.