QSN-8932-1: curl vulnerabilities
2026-10-14

Summary:
Several security issues were fixed in curl.

Details:
Stanislav Fort discovered that curl did not properly clear AWS SigV4
authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2026-86409)

Stanislav Fort discovered that an HTTP proxy could trick libcurl into
sending credentials to the proxy itself by responding to a CONNECT
request with an unexpected authentication challenge. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-86414)

Stanislav Fort discovered that curl did not correctly handle HSTS
entries when an includeSubDomains parent entry was imported before a
longer-lived child entry. An attacker could possibly use this issue to
cause curl to use unencrypted HTTP connections. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-87862)

Stanislav Fort discovered that curl did not properly handle HSTS max-age
values that exceeded calendar time structure bounds. An attacker could
possibly use this issue to cause a denial of service or data loss. This
issue only affected Ubuntu 24.04 LTS. (CVE-2026-87863)

Stanislav Fort discovered that curl did not properly handle IMAP APPEND
commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be
interpreted as pipelined commands. An authenticated attacker could
possibly use this issue to inject arbitrary IMAP commands.
(CVE-2026-87864)

Joshua Rogers discovered that libcurl had a use-after-free vulnerability
in the FTP wildcard matching code. An attacker could possibly use this
issue to cause curl to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-92388)

Joshua Rogers discovered that libcurl's TFTP state machine did not
properly validate transfer directions, allowing a malicious server to
force the client into transmit mode. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-92389)

Joshua Rogers discovered that curl had a stack overflow vulnerability
when processing deeply nested MIME structures. An attacker could
possibly use this issue to cause curl to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-92391)

Joshua Rogers discovered that libcurl could expose credentials in the
URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved
from a .netrc file. An attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-94266)

Affected QuantaStor releases:
  6.9.1.001 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.9.1.001 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.9.1.001 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.9.0.464 jammy: curl 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.9.0.464 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.9.0.464 jammy: libcurl4 7.81.0-1ubuntu1.30 (fixed in 7.81.0-1ubuntu1.30)
  6.8.6.015 jammy: curl 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.30)
  6.8.6.015 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.30)
  6.8.6.015 jammy: libcurl4 7.81.0-1ubuntu1.27 (fixed in 7.81.0-1ubuntu1.30)
  6.8.5.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.5.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.5.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.4.038 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.4.038 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.4.038 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.3.018 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.3.018 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.3.018 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.2.002 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.2.002 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.2.002 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.1.007 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.1.007 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.1.007 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.0.205 jammy: curl 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.0.205 jammy: libcurl3-gnutls 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)
  6.8.0.205 jammy: libcurl4 7.81.0-1ubuntu1.25 (fixed in 7.81.0-1ubuntu1.30)

CVEs: CVE-2026-92388, CVE-2026-92389, CVE-2026-87864, CVE-2026-87862, CVE-2026-94266, CVE-2026-87863, CVE-2026-92391, CVE-2026-86414, CVE-2026-86409

References:
  https://ubuntu.com/security/notices/USN-8932-1