IntroductionOn 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date. All operating systems that distribute curl are affected, including Linux distributions. CVE-2026-92392 only impacts Ubuntu 26.04 LTS (Resolute Raccoon). Ubuntu has released an update for Ubuntu 26.04 that addresses all vulnerabilities. Updates for all other supported releases, which are only affected by the low and medium severity vulnerabilities, will be available shortly.The vulnerabilities do not have CVSS scores assigned. CVE-2026-92392 was assessed by the Ubuntu Security Team to have a CVSS 3.1 score of 8.1, corresponding to a severity of HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).The vulnerabilities affect both the curl command-line utility and the libcurl library. The following are the identifiers associated with the vulnerabilities:CVE-2026-107929CVE-2026-107928CVE-2026-94266CVE-2026-94265CVE-2026-92392CVE-2026-92391CVE-2026-92390CVE-2026-92389CVE-2026-92388CVE-2026-92387CVE-2026-92386CVE-2026-87866CVE-2026-87865CVE-2026-87864CVE-2026-87863CVE-2026-87862CVE-2026-87861CVE-2026-86415CVE-2026-86414CVE-2026-86413CVE-2026-86412CVE-2026-86411CVE-2026-86410CVE-2026-86409Which Ubuntu releases are affected?ReleaseSource package nameRemediation statusTrusty (14.04)curlUpdate pendingNot affected by CVE-2026-92392Xenial (16.04)curlUpdate pendingNot affected by CVE-2026-92392Bionic (18.04)curlUpdate pendingNot affected by CVE-2026-92392Focal (20.04)curlUpdate pendingNot affected by CVE-2026-92392Jammy (22.04)curlUpdate pendingNot affected by CVE-2026-92392Noble (24.04)curlUpdate pendingNot affected by CVE-2026-92392Resolute (26.04)curlFixed in 8.18.0-1ubuntu2.8Affected by CVE-2026-92392How to check if you are impactedYou can verify the versions of any packages installed from the curl source package with the following command.apt list '?installed ?source-package(^curl$)'Impact of CVE-2026-92392CVE-2026-92392 is known to allow remote code execution. Successful exploitation requires a malicious server, so this issue can be mitigated by only contacting trusted servers. The conditions required to reach and exploit this issue are complex.Impact of the other vulnerabilitiesCVE-2026-92388 is also a use-after-free vulnerability, the same class as CVE-2026-92392. This class of vulnerabilities is typically considered to lead to remote code execution in conservative assessments. However, CVE-2026-92388 does not affect the curl command-line utility and is only applicable if an application using the libcurl library uses the FTP functionality in a certain way. The vulnerability has therefore been assessed by the curl project with a low severity.The other CVEs include leaking authentication credentials to incorrect connections through a variety of protocols and proxies (including Kerberos tickets); protocol state machine problems with TFTP and IMAP that could lead to denial-of-service or information disclosure issues; HTTP servers able to wipe or truncate cookie jars; HSTS expiration and durability issues; SSH host key checking issues; a data leak in the GnuTLS version; memory exhaustion leading to denial-of-service; two issues for TLS backends we do not support.How to apply fixesWe recommend you upgrade all packages:sudo apt update && sudo apt upgradeIf this is not possible, the affected component can be targeted:sudo apt update && sudo apt install --only-upgrade '?source-package(^curl$)'The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service: Applies new security updates every 24 hours automatically.If you have this enabled, the patches above will be automatically applied within 24 hours of being available.Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. If you are using Ubuntu 20.04 LTS or older, you can apply these fixes with an Ubuntu Pro subscription via the Expanded Security Maintenance (ESM) service once they are made available. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more >Further readinghttps://ubuntu.com/security/notices/USN-8927-1https://curl.se/docs/CVE-2026-107929.htmlhttps://curl.se/docs/CVE-2026-107928.htmlhttps://curl.se/docs/CVE-2026-94266.htmlhttps://curl.se/docs/CVE-2026-94265.htmlhttps://curl.se/docs/CVE-2026-92392.htmlhttps://curl.se/docs/CVE-2026-92391.htmlhttps://curl.se/docs/CVE-2026-92390.htmlhttps://curl.se/docs/CVE-2026-92389.htmlhttps://curl.se/docs/CVE-2026-92388.htmlhttps://curl.se/docs/CVE-2026-92387.htmlhttps://curl.se/docs/CVE-2026-92386.htmlhttps://curl.se/docs/CVE-2026-87866.htmlhttps://curl.se/docs/CVE-2026-87865.htmlhttps://curl.se/docs/CVE-2026-87864.htmlhttps://curl.se/docs/CVE-2026-87863.htmlhttps://curl.se/docs/CVE-2026-87862.htmlhttps://curl.se/docs/CVE-2026-87861.htmlhttps://curl.se/docs/CVE-2026-86415.htmlhttps://curl.se/docs/CVE-2026-86414.htmlhttps://curl.se/docs/CVE-2026-86413.htmlhttps://curl.se/docs/CVE-2026-86412.htmlhttps://curl.se/docs/CVE-2026-86411.htmlhttps://curl.se/docs/CVE-2026-86410.htmlhttps://curl.se/docs/CVE-2026-86409.html