USN-8932-1: curl vulnerabilities
Ubuntu patched curl flaws that could leak AWS SigV4 state or proxy credentials.
Ubuntu published USN-8932-1 for curl flaws discovered by Stanislav Fort that could expose sensitive authentication data. CVE-2026-86409 concerns AWS SigV4 state not being cleared when CURLOPT_AWS_SIGV4 is set to NULL, and it affects only Ubuntu 22.04 LTS and 24.04 LTS. CVE-2026-86414 lets an HTTP proxy elicit credentials by answering a CONNECT request with an unexpected authentication challenge. The notice also describes improper handling of HSTS entries when an includeSubDomains parent is imported.
- CVE-2026-86409: AWS SigV4 state not cleared when the option is set to NULL.
- That issue affects only Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
- CVE-2026-86414: a malicious HTTP proxy can capture credentials via a CONNECT challenge.
- The notice also describes incorrect handling of imported HSTS includeSubDomains entries.
Vulnerabilities mentionedAll →
- published —
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-86409 | NVD description · AI analysis pending | — | — |
Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414) Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported…
This source does not provide full text. Read it at ubuntu.com.