QSN-8651-1: curl vulnerability
2026-08-19

Summary:
curl could be made to expose sensitive information over the network.

Details:
It was discovered that curl incorrectly handled reusing connections
when the origin changed between transfers. A remote attacker could
possibly use this issue to obtain sensitive information.

Affected QuantaStor releases:
  6.9.1.001 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.9.1.001 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.9.1.001 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.9.0.464 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.9.0.464 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.9.0.464 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.26)
  6.8.6.015 jammy: curl 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.26)
  6.8.6.015 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.26)
  6.8.6.015 jammy: libcurl4 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.26)
  6.8.5.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.5.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.5.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.4.038 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.4.038 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.4.038 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.3.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.3.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.3.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.2.002 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.2.002 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.2.002 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.1.007 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.1.007 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.1.007 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.0.205 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.0.205 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)
  6.8.0.205 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.26)

CVEs: CVE-2026-11856

References:
  https://ubuntu.com/security/notices/USN-8651-1