USN-8932-1: curl vulnerabilities
Ubuntu patched curl flaws that could leak AWS SigV4 state or proxy credentials.
Ubuntu published USN-8932-1 for curl flaws discovered by Stanislav Fort that could expose sensitive authentication data. CVE-2026-86409 concerns AWS SigV4 state not being cleared when CURLOPT_AWS_SIGV4 is set to NULL, and it affects only Ubuntu 22.04 LTS and 24.04 LTS. CVE-2026-86414 lets an HTTP proxy elicit credentials by answering a CONNECT request with an unexpected authentication challenge. The notice also describes improper handling of HSTS entries when an includeSubDomains parent is imported.
48