Multiple curl Vulnerabilities Affecting Ubuntu
Recent security advisories have revealed multiple vulnerabilities in the curl tool, which is widely used for transferring data with URLs. These vulnerabilities could potentially allow remote code execution and denial of service, particularly affecting users of Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The vulnerabilities were reported in a security notice by Ubuntu.
One significant vulnerability, identified as CVE-2026-13608, was discovered by Eunsoo Kim. It pertains to the incorrect handling of SASL negotiation for LDAP authentication, which could allow a machine-in-the-middle attacker to bypass peer validation. This issue specifically affects Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
Another critical vulnerability, CVE-2026-18924, was found by Stephan Zeisberg. This flaw involves the mishandling of HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could exploit this vulnerability to crash curl, leading to a denial of service, or potentially execute arbitrary code.
Additionally, Stanislav Fort identified several other vulnerabilities, including CVE-2026-80229, which relates to the improper management of pooled TLS connections when using the multi interface. This could also result in a crash or arbitrary code execution, affecting Ubuntu 26.04 LTS.
Fort also reported CVE-2026-80230, where curl failed to enforce public key pinning when certificate verification was disabled, allowing remote attackers to bypass pinning checks. Another issue, CVE-2026-80255, involves the mishandling of the Secure attribute of cookies, which could lead to sensitive information exposure, again affecting Ubuntu 26.04 LTS.
Furthermore, CVE-2026-82209 highlights a failure to enforce Public Suffix List boundaries when handling cookies, potentially exposing sensitive information across unrelated domains. This vulnerability impacts multiple versions, including Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS.
Lastly, CVE-2026-8927 was discovered by Ady Elouej, which involves the failure to clear proxy authentication state between requests. This could allow remote attackers to obtain sensitive credentials, particularly affecting Ubuntu 16.04 LTS.
Organizations and users running affected versions of Ubuntu are strongly advised to apply the necessary security updates to mitigate these vulnerabilities. Regularly updating software and monitoring security advisories is crucial in maintaining a secure environment.
Follow Cyber Warriors Middle East for further cybersecurity resources, advisories and technical guidance.
