Package "libcurl4t64"

curl (8.18.0-1ubuntu2.8) resolute-security; urgency=medium

  [ Charles Cochran ]
  * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.
    - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()
      return value larger than the length given in lib/vtls/gtls.c.
    - CVE-2026-107928
  * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.
    - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE
      binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,
      lib/url.c, lib/urldata.h.
    - CVE-2026-107929
  * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.
    - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when
      CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,
      tests/libtest/lib1978.c.
    - CVE-2026-86409
  * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.
    - debian/patches/CVE-2026-86410.patch: always set the SSH host verification
      options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.
    - CVE-2026-86410
  * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.
    - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,
      except out of memory, when loading a cookie jar in lib/cookie.c.
    - CVE-2026-86412
  * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.
    - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a
      CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,
      tests/data/Makefile.am, tests/data/test2173.
    - CVE-2026-86414
  * SECURITY UPDATE: Improper handling of HSTS entries on load.
    - debian/patches/CVE-2026-87862.patch: match only the exact host, not
      parent domains, when removing duplicates while loading an HSTS file in
      lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.
    - CVE-2026-87862
  * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.
    - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip
      entries whose expiry cannot be formatted in lib/hsts.c,
      tests/data/Makefile.am, tests/data/test1862.
    - CVE-2026-87863
  * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.
    - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion
      makes the upload size unknown in lib/imap.c.
    - CVE-2026-87864
  * SECURITY UPDATE: Improper host key verification with libssh2 hashed
    known_hosts.
    - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by
      host before accepting them as found in lib/vssh/libssh2.c.
    - CVE-2026-87865
  * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.
    - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly
      longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.
    - CVE-2026-92386
  * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,
    IMAP, POP3 and SMTP.
    - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to
      Curl_pp_readresp in lib/pingpong.c.
    - CVE-2026-92387
  * SECURITY UPDATE: Use after free in FTP wildcard matching.
    - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func
      and set.out in lib/cw-out.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,
      lib/ftplistparser.h.
    - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the
      CURLWC_MATCHING state in lib/ftplistparser.c.
    - CVE-2026-92388
  * SECURITY UPDATE: Information exposure from TFTP transfer direction
    confusion.
    - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a
      server response does not match the transfer direction in lib/tftp.c.
    - CVE-2026-92389
  * SECURITY UPDATE: Improper file overwrite protection with
    --remote-header-name.
    - debian/patches/CVE-2026-92390.patch: buffer headers until the remote
      filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,
      tests/data/test3037, tests/data/test3038.
    - CVE-2026-92390
  * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.
    - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in
      curl_mime_free in lib/mime.c, tests/data/Makefile.am,
      tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.
    - CVE-2026-92391
  * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.
    - debian/patches/CVE-2026-94266.patch: return a copy of the URL without
      credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,
      lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.
    - CVE-2026-94266

  [ Marc Deslauriers ]
  * SECURITY UPDATE: HTTP/2 upload Use-After-Free
    - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in
      multi_done in lib/multi.c.
    - CVE-2026-92392

 -- Marc Deslauriers Tue, 13 Oct 2026 08:01:28 -0400

curl (8.18.0-1ubuntu2.7) resolute-security; urgency=medium

  [ Charles Cochran ]
  * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.
    - debian/patches/CVE-2026-13608.patch: openldap: handle
      Curl_sasl_continue() returns better in lib/openldap.c.
    - CVE-2026-13608
  * SECURITY UPDATE: Use after free in HTTP/2 server push.
    - debian/patches/CVE-2026-18924.patch: make server push transfers
      inherit share from parent in lib/http2.c.
    - CVE-2026-18924
  * SECURITY UPDATE: Use after free in OpenSSL library context.
    - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is
      used in lib/vtls/openssl.c.
    - CVE-2026-80229
  * SECURITY UPDATE: Public key pinning bypass.
    - debian/patches/CVE-2026-80230.patch: require server cert if public
      key pinned in lib/vtls/openssl.c.
    - CVE-2026-80230
  * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie.
    - debian/patches/CVE-2026-80255.patch: improve TAB handling in
      lib/cookie.c, tests/data/Makefile.am, tests/data/test2885.
    - CVE-2026-80255
  * SECURITY UPDATE: Cookie injection for public suffix domains.
    - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact
      PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am,
      tests/data/test1136, tests/data/test2318, tests/data/test798.
    - CVE-2026-82209
  * SECURITY REGRESSION: CVE-2026-9080: upstream pt 2 needed (LP: #2167969)
    - debian/patches/CVE-2026-9080-post1.patch: multi_ev: refresh sock
      entry after remove callback in lib/multi_ev.c.

  [ Kyle Kernick ]
  * SECURITY REGRESSION: checksrc errors and failing test case for
    CVE-2026-8927 (LP #2167779)
    - debian/patches/CVE-2026-11856.patch: Use curlx_strdup to fix
      autopkgtests
    - debian/patches/CVE-2026-8458.patch: Wrap long lines and remove unused
      variable to fix autopkgtests
    - debian/patches/CVE-2026-8927.patch: Fix failing test

 -- Charles Cochran Fri, 18 Sep 2026 14:17:09 -0400

curl (8.18.0-1ubuntu2.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Authentication Bypass in connection reuse.
    - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in
      lib/ldap.c, ../urldata.h, lib/vssh/libssh.c, ../libssh2.c,
      lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../rustls.c,
      ../schannel.c, ../vtls.c, ../vtls_scache.c, ../vtls_scache.h,
      and ../wolfssl.c.
    - CVE-2026-8932

 -- Kyle Kernick Fri, 21 Aug 2026 12:55:56 -0600

  curl (8.18.0-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Use after free in curl_easy_reset.
    - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in
      include/curl/curl.h, lib/http2.c,
      lib/setopt.c, lib/url.c, and lib/urldata.h
    - CVE-2026-10536
  * SECURITY UPDATE: Denial of service in QUIC UDP.
    - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets
      and enforce an upper bound in
      lib/vquic/vquic.c
    - CVE-2026-11352
  * SECURITY UPDATE: Improper certificate validation in native_ca_store.
    - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to
      keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to
      calculate every easy transfer if a native CA store shall be used or
      not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c
    - CVE-2026-11564
  * SECURITY UPDATE: Memory exhaustion in ws.c
    - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless
      there is sufficient space left in the websocket send buffer in
      lib/ws.c.
    - CVE-2026-11586
  * SECURITY UPDATE: Improper validation in config2setopts.
    - debian/patches/CVE-2026-12064.patch: Use default protocol properly in
      src/config2setopts.c.
    - CVE-2026-12064

 -- Kyle Kernick <email address hidden> Mon, 06 Jul 2026 10:45:44 -0600