USN-8927-1: curl vulnerabilities
Ubuntu’s USN-8927-1 patches curl flaws that may leak data or reuse the wrong network interface.
Ubuntu security notice USN-8927-1 covers several curl flaws. CVE-2026-107928 is an out-of-bounds read in the WebSocket send path when curl is built with GnuTLS, which could expose sensitive information. CVE-2026-107929 omits the CURLOPT_INTERFACE binding from connection-reuse decisions, potentially sending traffic from an unintended address. A further issue, reported by Stanislav Fort, fails to clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 is set to NULL; no exploitation is stated.
38