Seven curl Flaws Patched Across Every Supported Ubuntu LTS Release
Canonical published security notice USN-8820-1 on 24 September 2026, correcting seven separate vulnerabilities in curl and the libcurl client libraries. The affected packages ship on six long-term support releases at once: Ubuntu 26.04 LTS (resolute), 24.04 LTS (noble), 22.04 LTS (jammy), 20.04 LTS (focal), 18.04 LTS (bionic) and 16.04 LTS (xenial). The issues tracked are CVE-2026-13608, CVE-2026-18924, CVE-2026-80229, CVE-2026-80230, CVE-2026-80255, CVE-2026-82209 and CVE-2026-8927, and between them they cover peer validation bypass, memory corruption that could end in a crash or arbitrary code execution, cookie leakage to unrelated domains, certificate pinning that is not actually enforced, and proxy credentials surviving across requests. Not every flaw touches every release, so exposure differs by estate: CVE-2026-13608 affects only 24.04 and 26.04, CVE-2026-80229 and CVE-2026-80255 only 26.04, CVE-2026-82209 spans 18.04 through 26.04, and CVE-2026-8927 is a re-fix for 16.04 where the earlier correction shipped in USN-8487-1 was incomplete. Because libcurl is linked by a very large share of packaged software, the affected surface includes not just the curl command line tool but any local service that pulls in libcurl4, libcurl4t64, libcurl3-gnutls, libcurl3t64-gnutls or libcurl3-nss.
The advisory describes each defect at a functional level rather than publishing exploitation detail, and no proof-of-concept code accompanies it. CVE-2026-13608 stems from incorrect handling of SASL negotiation during LDAP authentication, which a machine-in-the-middle attacker could use to sidestep peer validation. CVE-2026-18924 involves mishandled HTTP/2 Server Push streams when a connection is shared between multiple easy handles, a condition a remote server could drive toward a crash or, in the worst case, code execution in the calling process. CVE-2026-80229 is a lifetime management error on pooled TLS connections used through the multi interface, with the same crash or code execution outcome. The remaining four are logic rather than memory faults: CVE-2026-80230 fails to enforce public key pinning when certificate verification has been switched off, so connections that pinning should have rejected are accepted; CVE-2026-80255 mishandles the Secure attribute on cookies; CVE-2026-82209 does not respect Public Suffix List boundaries, allowing cookies to be sent to unrelated domains; and CVE-2026-8927 leaves proxy authentication state in place between requests when a handle is reused with environment-variable proxy configuration, which can surface credentials to a remote party.
The strategic weight here comes from ubiquity rather than sophistication. curl and libcurl sit inside package managers, build pipelines, container base images, monitoring agents, backup tooling and countless application runtimes, so a single library update touches far more of an environment than the package name suggests, and an automated client that fetches from an attacker-influenced endpoint is exactly the pattern several of these flaws need. The confidentiality-side bugs are the quiet ones: cookies crossing a Public Suffix List boundary or a proxy Authorization header replayed to the wrong host leaks material that rarely shows up in logs as an incident. Current exploitation status is unremarkable across the set. FIRST EPSS places the 30-day probability of exploitation at 0.5 percent for CVE-2026-13608, 0.6 percent for CVE-2026-18924, 0.9 percent for CVE-2026-80229, 0.5 percent for CVE-2026-80230, 0.7 percent for CVE-2026-80255, 0.5 percent for CVE-2026-82209 and 0.5 percent for CVE-2026-8927, and none of the seven is reported as exploited in the wild. One operational wrinkle does stand out: the fixes for 20.04, 18.04 and 16.04 are delivered only through Ubuntu Pro, with 16.04 requiring the Legacy Support add-on, so organisations running those older estates without a Pro subscription have no update path available to them for these seven issues.
Attack Surface
Endpoint OS, Server OS, File Transfer
Tactics
Credential Access, Collection, Execution, Defense Evasion, Impact
Techniques
- T1557 – Adversary-in-the-Middle
- T1203 – Exploitation for Client Execution
- T1539 – Steal Web Session Cookie
- T1499 – Endpoint Denial of Service
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Apply the USN-8820-1 packages on currently supported releases: curl and libcurl to 8.18.0-1ubuntu2.7 on Ubuntu 26.04 LTS (resolute), 8.5.0-2ubuntu10.15 on 24.04 LTS (noble), and 7.81.0-1ubuntu1.29 on 22.04 LTS (jammy), covering libcurl4t64, libcurl3t64-gnutls, libcurl4, libcurl3-gnutls, libcurl3-nss and the matching -dev packages.
- For ESM estates, the fixes require an Ubuntu Pro subscription: 20.04 LTS (focal) needs 7.68.0-1ubuntu2.25+esm9, 18.04 LTS (bionic) needs 7.58.0-2ubuntu3.24+esm14, and 16.04 LTS (xenial) needs 7.47.0-1ubuntu2.19+esm20 via the Legacy Support add-on. Enrol or isolate these hosts, because no non-Pro update path exists.
- Treat Ubuntu 16.04 hosts as a separate work item for CVE-2026-8927 – the earlier fix delivered in USN-8487-1 was incomplete on xenial, so a host patched against that notice is still exposed until 7.47.0-1ubuntu2.19+esm20 is installed.
- After upgrading, identify long-running processes still mapping the old shared object with 'lsof +c 0 | grep -i libcurl' or 'needrestart -r l', and restart them – services that loaded libcurl4 or libcurl3-gnutls before the update keep the vulnerable code in memory.
- Where curl is invoked against LDAP endpoints and that protocol is not required, constrain it with '–proto -ldap,-ldaps' or build restrictions to remove the SASL negotiation path abused by CVE-2026-13608 on 24.04 and 26.04 hosts.
- Audit scripts and application code that combine '-k'/'–insecure' or CURLOPT_SSL_VERIFYPEER=0 with '–pinnedpubkey'/CURLOPT_PINNEDPUBLICKEY – under CVE-2026-80230 the pin is not enforced when verification is disabled, so those calls provide no protection at all.
- In applications using the libcurl multi interface with connection sharing, disable HTTP/2 Server Push by removing CURLMOPT_PUSHFUNCTION callbacks or forcing CURL_HTTP_VERSION_1_1 until the patched libcurl is deployed, to close the CVE-2026-18924 crash and code-execution path.
