USN-8820-1: curl vulnerabilities
Ubuntu patched curl flaws that may bypass LDAP peer checks or allow HTTP/2 crashes and code execution.
Ubuntu Security Notice USN-8820-1 covers multiple curl vulnerabilities. CVE-2026-13608, found by Eunsoo Kim, involves incorrect SASL negotiation during LDAP authentication; a machine-in-the-middle attacker could bypass peer validation, and it affects only Ubuntu 24.04 LTS and 26.04 LTS. CVE-2026-18924, found by Stephan Zeisberg, concerns mishandled HTTP/2 server-push streams on shared connections, which a remote attacker could use to crash curl or possibly execute arbitrary code. Stanislav Fort also reported incorrect lifetime management of pooled TLS connections when using curl's multi interface; the published notice text is truncated.
- CVE-2026-13608: LDAP SASL handling may let a MITM bypass peer validation.
- That issue affects only Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
- CVE-2026-18924: HTTP/2 server push on shared connections may crash curl or allow code execution.
- Stanislav Fort reported a pooled TLS connection lifetime bug in curl's multi interface.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-18924+1 related CVE | Use-After-Free in libcurl HTTP/2 Server Push Handling with Shared Connections | 9.1 group max | <1% | PoC |
From the original article
Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.