Ubuntu 26.10 curl checks certificate revocation; OpenSSL is next
The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.
Stories per day · 30 days
2 RSS
Relatedlibcurl5ubuntu5vulnerability-disclosure4anthropic3cve-2026-923923http23open-source3use-after-free3aws-sigv42certificate-revocation2crlite2glasswing2gnutls2hackerone2openssl2upki2usn2vulncheck2
20 stories, newest first · one card per story
Stories tagged #curl
Glasswing logs 37,966 findings but only 217 fixes in seven months
Only two of 442 tracked CVEs were exploited, while duplicates and withdrawals far outnumber the 217 marked fixes.
Curl adopts public disclosure for low and medium vulnerabilities
Open source projects should follow Curl's example and report low and medium severity issues publicly to reduce volunteer workload.
Beginner guide on bug bounties as AI reports strain programs
Curl ended its paid bounty on January 31, 2026 after confirmed findings fell below 5%, then later recovered near 15%.
1
PHP rebuilds Windows packages to fix Brotli flaw CVE-2026-111497
Rebuilt 8.2–8.5 Windows packages ship Brotli 1.2.1; cURL auto-decompression can reach the memory flaw, with no known attacks.
curl will handle low and medium vulnerability reports in public
From October 26, 2026, only high and critical reports stay private on HackerOne; over 90% of recent submissions were below high.
Curl moves low and medium vulnerability reports public on October 26
High and critical reports stay private; Stenberg says over 90 percent of recent submissions were below high.
2
Ubuntu 26.10 curl update fixes WebSocket read and reuse bugs
USN-8927-2 backports fixes for an out-of-bounds read and a connection-reuse flaw, CVE-2026-107928 and CVE-2026-107929.
USN-8932-1: curl vulnerabilities
Ubuntu patched curl flaws that could leak AWS SigV4 state or proxy credentials.
[SECURITY ADVISORIES] curl 8.23.0
curl 8.23.0 fixes high-severity HTTP/2 upload use-after-free CVE-2026-92392.
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
curl 8.23.0 fixes high-severity HTTP/2 use-after-free CVE-2026-92392 after a PoC showed client code execution.
USN-8927-1: curl vulnerabilities
Ubuntu’s USN-8927-1 patches curl flaws that may leak data or reuse the wrong network interface.
A UAF turned RCE
curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.
Twenty-two pending curl vulnerabilities
Curl 8.23.0, due October 14, will fix 22 flaws including high-severity CVE-2026-92392.
7
Google pauses open source bug bounty program after rise in AI submissions
Google paused its open-source bug bounty after invalid, mostly automated AI submissions overwhelmed reviewers.
Google halts open-source bug bounty program amid AI spam surge
Google paused OSS Vulnerability Rewards submissions after a surge of invalid AI-generated bug reports.
USN-8487-2: curl regression
Ubuntu patches an incomplete curl fix for CVE-2026-8927 and related connection-reuse flaws.
USN-8820-1: curl vulnerabilities
Ubuntu patched curl flaws that may bypass LDAP peer checks or allow HTTP/2 crashes and code execution.
USN-8670-3: curl vulnerability
Ubuntu issued USN-8670-3 updating curl for Ubuntu 26.04 LTS to fix a flaw where wrong client certificates could be used on reused connections.
curl: a CVE dispute
curl maintainer Daniel Stenberg details a dispute over a CVE assigned to the curl project.