← All notices | Source (USN-8820-1) | Text version

QSN-8820-1: curl vulnerabilities

September 24, 2026

Summary

Several security issues were fixed in curl.

Details

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate verification was disabled in certain circumstances. A remote attacker could possibly use this issue to bypass pinning checks and cause curl to accept connections that should have been rejected. (CVE-2026-80230)

Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)

Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.9.0.464Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.307.81.0-1ubuntu1.29Fixed in this release
6.8.6.015Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.277.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.277.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.277.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTScurlInternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibcurl3-gnutlsExternally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibcurl4Internally-facing7.81.0-1ubuntu1.257.81.0-1ubuntu1.29Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-80229, CVE-2026-82209, CVE-2026-8927, CVE-2026-80230, CVE-2026-13608, CVE-2026-18924, CVE-2026-80255

References

https://ubuntu.com/security/notices/USN-8820-1

https://nvd.nist.gov/vuln/detail/CVE-2026-80229

https://nvd.nist.gov/vuln/detail/CVE-2026-82209

https://nvd.nist.gov/vuln/detail/CVE-2026-8927

https://nvd.nist.gov/vuln/detail/CVE-2026-80230

https://nvd.nist.gov/vuln/detail/CVE-2026-13608

https://nvd.nist.gov/vuln/detail/CVE-2026-18924

https://nvd.nist.gov/vuln/detail/CVE-2026-80255

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bioniccurl7.58.0-2ubuntu3.24+esm14
Ubuntu 20.04 LTScurl7.68.0-1ubuntu2.25+esm9
Ubuntu 22.04 LTScurl7.81.0-1ubuntu1.29
Ubuntu 24.04 LTScurl8.5.0-2ubuntu10.15
resolutecurl8.18.0-1ubuntu2.7
xenialcurl7.47.0-1ubuntu2.19+esm20