Ubuntu 26.10 curl update fixes WebSocket read and reuse bugs
Original title: USN-8927-2: curl vulnerabilities
USN-8927-2 backports fixes for an out-of-bounds read and a connection-reuse flaw, CVE-2026-107928 and CVE-2026-107929.
Ubuntu published USN-8927-2 with curl fixes for Ubuntu 26.10, corresponding to USN-8927-1. With GnuTLS, curl can read out of bounds on the WebSocket send path and may expose sensitive information. A separate bug can ignore CURLOPT_INTERFACE during connection reuse and send traffic from an unintended address. The notice also starts describing an AWS SigV4 state-clearing issue, but the text is cut off.
Unconfirmed: The feed snippet cuts off before fully describing the AWS SigV4 issue.
- CVE-2026-107928 is an out-of-bounds read on the WebSocket send path.
- CVE-2026-107929 can reuse a connection from an unintended source address.
- The snippet begins a third issue involving AWS SigV4 authentication state.
Impact: Sensitive information disclosure or an unintended source address
| Product | Affected |
|---|---|
| curl | Ubuntu 26.10 builds |
- 1.Install the Ubuntu 26.10 curl updates from USN-8927-2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107928 | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer | 8.1 | — | ||
| CVE-2026-107929 | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding… | 8.1 | — |
From the original article
USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26. 10.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.