Fixes available for CVE-2026-92392 and other curl vulnerabilities

Key points

Ubuntu has released updated curl packages for every affected release, from 14.04 to 26.04 LTS, fixing a batch of curl and libcurl vulnerabilities disclosed upstream on 14 October 2026. One of them, CVE-2026-92392, is rated high severity and affects only Ubuntu 26.04 LTS; the others are low or medium. The updates are USN-8927-1 and USN-8932-1.

Background

• On 7 October 2026 curl maintainer Daniel Stenberg announced a release for 14 October 2026 to fix 22 security vulnerabilities. Ubuntu's post lists 24 CVE identifiers.
• Downstream vendors, including Ubuntu, received the details under embargo, and disclosure happened on the planned date.
• Every operating system that ships curl is affected, including Linux distributions.
• Both the curl command-line tool and the libcurl library are affected.

Fixed versions by release

• Ubuntu 26.04 LTS (Resolute): curl 8.18.0-1ubuntu2.8. The only release affected by CVE-2026-92392.
• Ubuntu 24.04 LTS (Noble): 8.5.0-2ubuntu10.16.
• Ubuntu 22.04 LTS (Jammy): 7.81.0-1ubuntu1.30.
• Ubuntu 20.04 LTS (Focal): 7.68.0-1ubuntu2.25+esm10.
• Ubuntu 18.04 LTS (Bionic): 7.58.0-2ubuntu3.24+esm15.
• Ubuntu 16.04 LTS (Xenial): 7.47.0-1ubuntu2.19+esm21.
• Ubuntu 14.04 LTS (Trusty): 7.35.0-1ubuntu2.20+esm24.

CVE-2026-92392 (high)

• Upstream assigned no CVSS scores. The Ubuntu Security Team rates this one CVSS 3.1 8.1, HIGH (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
• It can allow remote code execution, but only through a malicious server, and the conditions needed to reach and exploit it are complex.
• Until you patch, you can reduce the risk by connecting only to trusted servers.

Other vulnerabilities

• CVE-2026-92388 is a use-after-free, the same class as CVE-2026-92392. It does not affect the curl tool and only applies to applications that use libcurl's FTP support in a particular way, so the curl project rated it low.
• Several issues leak authentication credentials, including Kerberos tickets, to the wrong connections across various protocols and proxies.
• TFTP and IMAP state-machine bugs can cause denial of service or information disclosure.
• HTTP servers can wipe or truncate cookie jars.
• There are problems with HSTS expiry and persistence, and with SSH host key checking.
• The GnuTLS build has a data leak.
• Memory exhaustion can cause denial of service.
• Two issues concern TLS backends that Ubuntu does not support.
• All identifiers: CVE-2026-107929, CVE-2026-107928, CVE-2026-94266, CVE-2026-94265, CVE-2026-92392, CVE-2026-92391, CVE-2026-92390, CVE-2026-92389, CVE-2026-92388, CVE-2026-92387, CVE-2026-92386, CVE-2026-87866, CVE-2026-87865, CVE-2026-87864, CVE-2026-87863, CVE-2026-87862, CVE-2026-87861, CVE-2026-86415, CVE-2026-86414, CVE-2026-86413, CVE-2026-86412, CVE-2026-86411, CVE-2026-86410, CVE-2026-86409.

How to check and update

• Check which packages from the curl source package are installed, and their versions:

apt list '?installed ?source-package(^curl$)'

• Ubuntu recommends a full upgrade:

sudo apt update && sudo apt upgrade

• If a full upgrade is not possible, update only the curl packages:

sudo apt update && sudo apt install --only-upgrade '?source-package(^curl$)'

• On 16.04 LTS and later, unattended-upgrades is on by default and installs security updates every 24 hours, so systems with it enabled get the fixes within a day of their release.

Support coverage

• 26.04 LTS, 24.04 LTS and 22.04 LTS get these fixes under standard support.
• 20.04 LTS and older get them through Expanded Security Maintenance (ESM), which requires an Ubuntu Pro subscription.
• Ubuntu Pro is free for up to 5 machines, or up to 50 for community members, and includes Landscape for managing how security fixes roll out across many systems.

Summary by DistroNews, based on the original post.