Ubuntu publishes two October curl security notices

Ubuntu’s USN-8927-1 and USN-8932-1 patch curl flaws that may leak data, reuse the wrong interface, or expose credentials.

On 14 October 2026 Ubuntu published two curl security notices. USN-8927-1 covers CVE-2026-107928, an out-of-bounds read in the WebSocket send path when curl is built with GnuTLS that could expose sensitive information, and CVE-2026-107929, which omits CURLOPT_INTERFACE from connection-reuse decisions and may send traffic from an unintended address. That notice also describes, without a CVE identifier, a failure to clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 is set to NULL, reported by Stanislav Fort, and says exploitation is not reported. Later the same day, USN-8932-1 assigns CVE-2026-86409 to that SigV4-clearing failure and says it affects only Ubuntu 22.04 LTS and 24.04 LTS. USN-8932-1 also covers CVE-2026-86414, in which a malicious HTTP proxy can capture credentials via an unexpected CONNECT authentication challenge, and describes improper handling of imported HSTS includeSubDomains entries. The notices match on the SigV4 mechanism but differ on whether it has a CVE and which releases are affected.

• On 2026-10-14 Ubuntu published USN-8927-1 for curl flaws CVE-2026-107928 and CVE-2026-107929.
• CVE-2026-107928 is an out-of-bounds read in the WebSocket send path when curl is built with GnuTLS and could expose sensitive information.
• CVE-2026-107929 omits CURLOPT_INTERFACE from connection-reuse decisions and may send traffic from an unintended address.
• Both notices describe AWS SigV4 state left uncleared when CURLOPT_AWS_SIGV4 is set to NULL; only USN-8932-1 labels it CVE-2026-86409 and says it affects only Ubuntu 22.04 LTS and 24.04 LTS.
• CVE-2026-86414 lets a malicious HTTP proxy capture credentials by answering a CONNECT request with an unexpected authentication challenge.
• USN-8932-1 also describes incorrect handling of imported HSTS includeSubDomains entries.
• Stanislav Fort is named as the reporter; USN-8927-1 says exploitation is not reported.