|
curl (8.20.0-2ubuntu11.1) stonking-security; urgency=medium
[ Charles Cochran ]
* SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.
- debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()
return value larger than the length given in lib/vtls/gtls.c.
- CVE-2026-107928
* SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.
- debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE
binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,
lib/url.c, lib/urldata.h.
- CVE-2026-107929
* SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.
- debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when
CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,
tests/libtest/lib1978.c.
- CVE-2026-86409
* SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.
- debian/patches/CVE-2026-86410.patch: always set the SSH host verification
options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.
- CVE-2026-86410
* SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.
- debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,
except out of memory, when loading a cookie jar in lib/cookie.c.
- CVE-2026-86412
* SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.
- debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a
CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,
tests/data/Makefile.am, tests/data/test2173.
- CVE-2026-86414
* SECURITY UPDATE: Improper handling of HSTS entries on load.
- debian/patches/CVE-2026-87862.patch: match only the exact host, not
parent domains, when removing duplicates while loading an HSTS file in
lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.
- CVE-2026-87862
* SECURITY UPDATE: Data loss from out-of-range HSTS max-age.
- debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip
entries whose expiry cannot be formatted in lib/hsts.c,
tests/data/Makefile.am, tests/data/test1862.
- CVE-2026-87863
* SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.
- debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion
makes the upload size unknown in lib/imap.c.
- CVE-2026-87864
* SECURITY UPDATE: Improper host key verification with libssh2 hashed
known_hosts.
- debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by
host before accepting them as found in lib/vssh/libssh2.c,
tests/data/Makefile.am, tests/libtest/Makefile.am, tests/data/test3500,
tests/libtest/test3500.pl.
- CVE-2026-87865
* SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.
- debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly
longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.
- CVE-2026-92386
* SECURITY UPDATE: Denial of service from unbounded response reading in FTP,
IMAP, POP3 and SMTP.
- debian/patches/CVE-2026-92387.patch: add a maximum loop counter to
Curl_pp_readresp in lib/pingpong.c.
- CVE-2026-92387
* SECURITY UPDATE: Use after free in FTP wildcard matching.
- debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func
and set.out in lib/cw-out.c, lib/ftp-int.h, lib/ftp.c,
lib/ftplistparser.c, lib/ftplistparser.h.
- debian/patches/CVE-2026-92388-2.patch: only use the list parser in the
CURLWC_MATCHING state in lib/ftplistparser.c.
- CVE-2026-92388
* SECURITY UPDATE: Information exposure from TFTP transfer direction
confusion.
- debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a
server response does not match the transfer direction in lib/tftp.c.
- CVE-2026-92389
* SECURITY UPDATE: Improper file overwrite protection with
--remote-header-name.
- debian/patches/CVE-2026-92390.patch: buffer headers until the remote
filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,
tests/data/test3037, tests/data/test3038.
- CVE-2026-92390
* SECURITY UPDATE: Stack overflow from deeply nested MIME structures.
- debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in
curl_mime_free in lib/mime.c, tests/data/Makefile.am,
tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.
- CVE-2026-92391
* SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.
- debian/patches/CVE-2026-94266.patch: return a copy of the URL without
credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,
lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.
- CVE-2026-94266
[ Marc Deslauriers ]
* SECURITY UPDATE: HTTP/2 upload Use-After-Free
- debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in
multi_done in lib/multi.c.
- CVE-2026-92392
-- Marc Deslauriers Fri, 16 Oct 2026 09:34:53 -0400
|
| CVE-2026-107928 |
When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read fol |
| CVE-2026-107929 |
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), th |
| CVE-2026-86409 |
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on t |
| CVE-2026-86410 |
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as |
| CVE-2026-86412 |
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same |
| CVE-2026-86414 |
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answer |
| CVE-2026-87862 |
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, |
| CVE-2026-87863 |
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit sy |
| CVE-2026-87864 |
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded da |
| CVE-2026-87865 |
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a |
| CVE-2026-92386 |
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length |
| CVE-2026-92387 |
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its co |
| CVE-2026-92388 |
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the |
| CVE-2026-92389 |
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for bot |
| CVE-2026-92390 |
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints |
| CVE-2026-92391 |
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An exces |
| CVE-2026-94266 |
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the U |
| CVE-2026-92392 |
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use |
|
