1. Blog
  2. Article

Luci Stanescu
14 October 2026

Fixes available for CVE-2026-92392 and other curl vulnerabilities

Security Vulnerabilities

Introduction

On 7 October 2026, Daniel Stenberg published a blog post describing a plan to release a new version of curl on 14 October 2026 in order to address 22 known security vulnerabilities. These vulnerabilities have varying severities, with a single vulnerability assessed as high (CVE-2026-92392), while the others have a low or medium severity. The curl maintainer has coordinated with downstream vendors, including Ubuntu, under embargo and the vulnerabilities have been publicly disclosed on the planned date. All operating systems that distribute curl are affected, including Linux distributions. Ubuntu has released updates that address all vulnerabilities for all affected releases: USN-8927-1 and USN-8932-1. CVE-2026-92392 only impacts Ubuntu 26.04 LTS (Resolute Raccoon).

The vulnerabilities do not have CVSS scores assigned. CVE-2026-92392 was assessed by the Ubuntu Security Team to have a CVSS 3.1 score of 8.1, corresponding to a severity of HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerabilities affect both the curl command-line utility and the libcurl library. The following are the identifiers associated with the vulnerabilities:

Which Ubuntu releases are affected?

ReleaseSource package nameRemediation status
Trusty (14.04)curlFixed in 7.35.0-1ubuntu2.20+esm24
Not affected by CVE-2026-92392
Xenial (16.04)curlFixed in 7.47.0-1ubuntu2.19+esm21
Not affected by CVE-2026-92392
Bionic (18.04)curlFixed in 7.58.0-2ubuntu3.24+esm15
Not affected by CVE-2026-92392
Focal (20.04)curlFixed in 7.68.0-1ubuntu2.25+esm10
Not affected by CVE-2026-92392
Jammy (22.04)curlFixed in 7.81.0-1ubuntu1.30
Not affected by CVE-2026-92392
Noble (24.04)curlFixed in 8.5.0-2ubuntu10.16
Not affected by CVE-2026-92392
Resolute (26.04)curlFixed in 8.18.0-1ubuntu2.8
Affected by CVE-2026-92392

How to check if you are impacted

You can verify the versions of any packages installed from the curl source package with the following command.

apt list '?installed ?source-package(^curl$)'

Impact of CVE-2026-92392

CVE-2026-92392 is known to allow remote code execution. Successful exploitation requires a malicious server, so this issue can be mitigated by only contacting trusted servers. The conditions required to reach and exploit this issue are complex.

Impact of the other vulnerabilities

CVE-2026-92388 is also a use-after-free vulnerability, the same class as CVE-2026-92392. This class of vulnerabilities is typically considered to lead to remote code execution in conservative assessments. However, CVE-2026-92388 does not affect the curl command-line utility and is only applicable if an application using the libcurl library uses the FTP functionality in a certain way. The vulnerability has therefore been assessed by the curl project with a low severity.

The other CVEs include leaking authentication credentials to incorrect connections through a variety of protocols and proxies (including Kerberos tickets); protocol state machine problems with TFTP and IMAP that could lead to denial-of-service or information disclosure issues; HTTP servers able to wipe or truncate cookie jars; HSTS expiration and durability issues; SSH host key checking issues; a data leak in the GnuTLS version; memory exhaustion leading to denial-of-service; two issues for TLS backends we do not support.

How to apply fixes

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade

If this is not possible, the affected component can be targeted:

sudo apt update && sudo apt install --only-upgrade '?source-package(^curl$)'

The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service:  

  • Applies new security updates every 24 hours automatically.
  • If you have this enabled, the patches above will be automatically applied within 24 hours of being available.

Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. If you are using Ubuntu 20.04 LTS or older, you can apply this fix with an Ubuntu Pro subscription via the Expanded Security Maintenance (ESM) service. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate.

Learn more >

Further reading

Related posts

Januscape vulnerability CVE-2026-53359 mitigations available

Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID...

seth-arnold

DirtyClone Linux kernel local privilege escalation vulnerability fixes available

On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed...

Luci Stanescu

pedit COW kernel local privilege escalation vulnerability mitigations

Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)...

Luci Stanescu

PinTheft Linux kernel vulnerability mitigation

A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the...

seth-arnold