Vulnerability-Lookup

ubuntu-cve-2026-9547

Vulnerability from osv_ubuntu

Published

2026-06-24 14:00

Modified

2026-07-08 07:51

Summary

Details

When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Severity

7.4 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2026-9547	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-9547	REPORT
	https://curl.se/L7HzKXisfJ/CVE-2026-9547.md	REPORT
	https://ubuntu.com/security/notices/USN-8487-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.25"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.25?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8",
        "7.81.0-1ubuntu1.10",
        "7.81.0-1ubuntu1.11",
        "7.81.0-1ubuntu1.13",
        "7.81.0-1ubuntu1.14",
        "7.81.0-1ubuntu1.15",
        "7.81.0-1ubuntu1.16",
        "7.81.0-1ubuntu1.17",
        "7.81.0-1ubuntu1.18",
        "7.81.0-1ubuntu1.19",
        "7.81.0-1ubuntu1.20",
        "7.81.0-1ubuntu1.21",
        "7.81.0-1ubuntu1.22",
        "7.81.0-1ubuntu1.23",
        "7.81.0-1ubuntu1.24"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.5.0-2ubuntu10.10"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.5.0-2ubuntu10.10?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.0-2ubuntu10.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.2.1-1ubuntu3",
        "8.2.1-1ubuntu3.1",
        "8.4.0-2ubuntu1",
        "8.5.0-2ubuntu1",
        "8.5.0-2ubuntu2",
        "8.5.0-2ubuntu8",
        "8.5.0-2ubuntu9",
        "8.5.0-2ubuntu10",
        "8.5.0-2ubuntu10.1",
        "8.5.0-2ubuntu10.2",
        "8.5.0-2ubuntu10.3",
        "8.5.0-2ubuntu10.4",
        "8.5.0-2ubuntu10.5",
        "8.5.0-2ubuntu10.6",
        "8.5.0-2ubuntu10.7",
        "8.5.0-2ubuntu10.8",
        "8.5.0-2ubuntu10.9"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.4"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.14.1-2ubuntu1.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.14.1-2ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.12.1-3ubuntu1",
        "8.13.0-5ubuntu1",
        "8.14.1-1ubuntu2",
        "8.14.1-1ubuntu3",
        "8.14.1-2ubuntu1",
        "8.14.1-2ubuntu1.1",
        "8.14.1-2ubuntu1.2",
        "8.14.1-2ubuntu1.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.2"
          }
        ],
        "priority_reason": "Upstream defined this as low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1"
      ]
    }
  ],
  "aliases": [],
  "details": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.",
  "id": "UBUNTU-CVE-2026-9547",
  "modified": "2026-07-08T07:51:40Z",
  "published": "2026-06-24T14:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9547"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
    },
    {
      "type": "REPORT",
      "url": "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8487-1"
    }
  ],
  "related": [
    "USN-8487-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-9547"
  ]
}

CVE-2026-9547 (GCVE-0-2026-9547)

Vulnerability from cvelistv5 – Published: 2026-07-03 06:18 – Updated: 2026-07-06 16:48

Title

SSH improper host validation

Summary

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-297 Improper Validation of Certificate with Host Mismatch

Assigner

curl

References

3 references

URL	Tags
https://curl.se/docs/CVE-2026-9547.json
https://curl.se/docs/CVE-2026-9547.html
https://hackerone.com/reports/3751712

Impacted products

1 product

Vendor	Product	Version
curl	curl	Affected: 8.20.0 , ≤ 8.20.0 (semver) Affected: 8.19.0 , ≤ 8.19.0 (semver) Affected: 8.18.0 , ≤ 8.18.0 (semver) Affected: 8.17.0 , ≤ 8.17.0 (semver) Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver)

Credits

Joshua Rogers (Aisle Research) Joshua Rogers (Aisle Research)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-9547",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T16:47:32.456534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T16:48:14.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3751712"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThanOrEqual": "8.20.0",
              "status": "affected",
              "version": "8.20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.19.0",
              "status": "affected",
              "version": "8.19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.17.0",
              "status": "affected",
              "version": "8.17.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.16.0",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.15.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.1",
              "status": "affected",
              "version": "8.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.14.0",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.13.0",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.1",
              "status": "affected",
              "version": "8.12.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0",
              "status": "affected",
              "version": "8.12.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.1",
              "status": "affected",
              "version": "8.11.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.11.0",
              "status": "affected",
              "version": "8.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.1",
              "status": "affected",
              "version": "8.10.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0",
              "status": "affected",
              "version": "8.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.1",
              "status": "affected",
              "version": "8.9.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.9.0",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.8.0",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.1",
              "status": "affected",
              "version": "8.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.7.0",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.6.0",
              "status": "affected",
              "version": "8.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.4.0",
              "status": "affected",
              "version": "8.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.3.0",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "8.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.2.0",
              "status": "affected",
              "version": "8.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.2",
              "status": "affected",
              "version": "8.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.1",
              "status": "affected",
              "version": "8.1.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.1.0",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.0.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.1",
              "status": "affected",
              "version": "7.88.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.88.0",
              "status": "affected",
              "version": "7.88.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.87.0",
              "status": "affected",
              "version": "7.87.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.86.0",
              "status": "affected",
              "version": "7.86.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.85.0",
              "status": "affected",
              "version": "7.85.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.84.0",
              "status": "affected",
              "version": "7.84.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.1",
              "status": "affected",
              "version": "7.83.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.83.0",
              "status": "affected",
              "version": "7.83.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.82.0",
              "status": "affected",
              "version": "7.82.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.81.0",
              "status": "affected",
              "version": "7.81.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.80.0",
              "status": "affected",
              "version": "7.80.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.1",
              "status": "affected",
              "version": "7.79.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.79.0",
              "status": "affected",
              "version": "7.79.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.78.0",
              "status": "affected",
              "version": "7.78.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.77.0",
              "status": "affected",
              "version": "7.77.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.1",
              "status": "affected",
              "version": "7.76.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.76.0",
              "status": "affected",
              "version": "7.76.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.75.0",
              "status": "affected",
              "version": "7.75.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.74.0",
              "status": "affected",
              "version": "7.74.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.73.0",
              "status": "affected",
              "version": "7.73.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.72.0",
              "status": "affected",
              "version": "7.72.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.1",
              "status": "affected",
              "version": "7.71.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.71.0",
              "status": "affected",
              "version": "7.71.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.70.0",
              "status": "affected",
              "version": "7.70.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.1",
              "status": "affected",
              "version": "7.69.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.69.0",
              "status": "affected",
              "version": "7.69.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Joshua Rogers (Aisle Research)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-03T06:18:44.499Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "name": "json",
          "url": "https://curl.se/docs/CVE-2026-9547.json"
        },
        {
          "name": "www",
          "url": "https://curl.se/docs/CVE-2026-9547.html"
        },
        {
          "name": "issue",
          "url": "https://hackerone.com/reports/3751712"
        }
      ],
      "title": "SSH improper host validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2026-9547",
    "datePublished": "2026-07-03T06:18:44.499Z",
    "dateReserved": "2026-05-26T06:45:27.665Z",
    "dateUpdated": "2026-07-06T16:48:14.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8487-1

Vulnerability from osv_ubuntu

Published

2026-06-30 21:34

Modified

2026-07-08 07:27

Summary

curl vulnerabilities

Details

Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use this issue to cause curl to use an unintended TLS configuration. (CVE-2026-8286)

Muhamad Arga Reksapati discovered that curl incorrectly reused connections for Negotiate-authenticated requests when different services were involved. A remote attacker could possibly use this issue to access resources authenticated for another service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)

It was discovered that curl incorrectly handled cookie parsing in certain circumstances. A remote attacker could possibly use this issue to set cookies that would be transmitted to unrelated third-party domains. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8924)

Joshua Rogers discovered that curl could double-free a GSASL context when handling SASL authentication. A remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8925)

Joshua Rogers discovered that curl could select the wrong password from a .netrc file when a username was specified in the URL without a password. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-8926)

Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to obtain sensitive credentials. (CVE-2026-8927)

Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li discovered that curl did not properly clear proxy authentication credentials when instructed to do so. A remote attacker could possibly use this issue to obtain sensitive credentials. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9079)

Joshua Rogers discovered that curl contained a use-after-free when curl_easy_pause() was called within the event-based socket callback. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9080)

Eunsoo Kim discovered that curl could send early data on a resumed TLS session before enforcing certificate verification failure. A machine-in-the-middle attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-9545)

Joshua Rogers discovered that curl did not properly reject host key type mismatches when using the SSH key callback for SCP and SFTP transfers. A machine-in-the-middle attacker could possibly use this issue to impersonate a trusted server. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-9547)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8487-1	ADVISORY
	https://ubuntu.com/security/CVE-2026-8286	REPORT
	https://ubuntu.com/security/CVE-2026-8458	REPORT
	https://ubuntu.com/security/CVE-2026-8924	REPORT
	https://ubuntu.com/security/CVE-2026-8925	REPORT
	https://ubuntu.com/security/CVE-2026-8926	REPORT
	https://ubuntu.com/security/CVE-2026-8927	REPORT
	https://ubuntu.com/security/CVE-2026-9079	REPORT
	https://ubuntu.com/security/CVE-2026-9080	REPORT
	https://ubuntu.com/security/CVE-2026-9545	REPORT
	https://ubuntu.com/security/CVE-2026-9547	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.35.0-1ubuntu2.20+esm20"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.20+esm20?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.35.0-1ubuntu2.20+esm20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.32.0-1ubuntu1",
        "7.33.0-1ubuntu1",
        "7.34.0-1ubuntu1",
        "7.35.0-1ubuntu1",
        "7.35.0-1ubuntu2",
        "7.35.0-1ubuntu2.1",
        "7.35.0-1ubuntu2.2",
        "7.35.0-1ubuntu2.3",
        "7.35.0-1ubuntu2.5",
        "7.35.0-1ubuntu2.6",
        "7.35.0-1ubuntu2.7",
        "7.35.0-1ubuntu2.8",
        "7.35.0-1ubuntu2.9",
        "7.35.0-1ubuntu2.10",
        "7.35.0-1ubuntu2.11",
        "7.35.0-1ubuntu2.12",
        "7.35.0-1ubuntu2.13",
        "7.35.0-1ubuntu2.14",
        "7.35.0-1ubuntu2.15",
        "7.35.0-1ubuntu2.16",
        "7.35.0-1ubuntu2.17",
        "7.35.0-1ubuntu2.19",
        "7.35.0-1ubuntu2.20",
        "7.35.0-1ubuntu2.20+esm2",
        "7.35.0-1ubuntu2.20+esm3",
        "7.35.0-1ubuntu2.20+esm4",
        "7.35.0-1ubuntu2.20+esm5",
        "7.35.0-1ubuntu2.20+esm6",
        "7.35.0-1ubuntu2.20+esm7",
        "7.35.0-1ubuntu2.20+esm8",
        "7.35.0-1ubuntu2.20+esm9",
        "7.35.0-1ubuntu2.20+esm10",
        "7.35.0-1ubuntu2.20+esm11",
        "7.35.0-1ubuntu2.20+esm12",
        "7.35.0-1ubuntu2.20+esm13",
        "7.35.0-1ubuntu2.20+esm14",
        "7.35.0-1ubuntu2.20+esm15",
        "7.35.0-1ubuntu2.20+esm16",
        "7.35.0-1ubuntu2.20+esm17",
        "7.35.0-1ubuntu2.20+esm18",
        "7.35.0-1ubuntu2.20+esm19"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.47.0-1ubuntu2.19+esm16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.19+esm16?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.47.0-1ubuntu2.19+esm16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.43.0-1ubuntu2",
        "7.45.0-1ubuntu1",
        "7.46.0-1ubuntu1",
        "7.47.0-1ubuntu1",
        "7.47.0-1ubuntu2",
        "7.47.0-1ubuntu2.1",
        "7.47.0-1ubuntu2.2",
        "7.47.0-1ubuntu2.3",
        "7.47.0-1ubuntu2.4",
        "7.47.0-1ubuntu2.5",
        "7.47.0-1ubuntu2.6",
        "7.47.0-1ubuntu2.7",
        "7.47.0-1ubuntu2.8",
        "7.47.0-1ubuntu2.9",
        "7.47.0-1ubuntu2.11",
        "7.47.0-1ubuntu2.12",
        "7.47.0-1ubuntu2.13",
        "7.47.0-1ubuntu2.14",
        "7.47.0-1ubuntu2.15",
        "7.47.0-1ubuntu2.16",
        "7.47.0-1ubuntu2.18",
        "7.47.0-1ubuntu2.19",
        "7.47.0-1ubuntu2.19+esm1",
        "7.47.0-1ubuntu2.19+esm2",
        "7.47.0-1ubuntu2.19+esm3",
        "7.47.0-1ubuntu2.19+esm4",
        "7.47.0-1ubuntu2.19+esm5",
        "7.47.0-1ubuntu2.19+esm6",
        "7.47.0-1ubuntu2.19+esm7",
        "7.47.0-1ubuntu2.19+esm8",
        "7.47.0-1ubuntu2.19+esm9",
        "7.47.0-1ubuntu2.19+esm10",
        "7.47.0-1ubuntu2.19+esm11",
        "7.47.0-1ubuntu2.19+esm12",
        "7.47.0-1ubuntu2.19+esm13",
        "7.47.0-1ubuntu2.19+esm15"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.58.0-2ubuntu3.24+esm9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.58.0-2ubuntu3.24+esm9?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.58.0-2ubuntu3.24+esm9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.55.1-1ubuntu2",
        "7.55.1-1ubuntu2.1",
        "7.57.0-1ubuntu1",
        "7.58.0-2ubuntu1",
        "7.58.0-2ubuntu2",
        "7.58.0-2ubuntu3",
        "7.58.0-2ubuntu3.1",
        "7.58.0-2ubuntu3.2",
        "7.58.0-2ubuntu3.3",
        "7.58.0-2ubuntu3.5",
        "7.58.0-2ubuntu3.6",
        "7.58.0-2ubuntu3.7",
        "7.58.0-2ubuntu3.8",
        "7.58.0-2ubuntu3.9",
        "7.58.0-2ubuntu3.10",
        "7.58.0-2ubuntu3.12",
        "7.58.0-2ubuntu3.13",
        "7.58.0-2ubuntu3.14",
        "7.58.0-2ubuntu3.15",
        "7.58.0-2ubuntu3.16",
        "7.58.0-2ubuntu3.17",
        "7.58.0-2ubuntu3.18",
        "7.58.0-2ubuntu3.19",
        "7.58.0-2ubuntu3.20",
        "7.58.0-2ubuntu3.21",
        "7.58.0-2ubuntu3.22",
        "7.58.0-2ubuntu3.23",
        "7.58.0-2ubuntu3.24",
        "7.58.0-2ubuntu3.24+esm1",
        "7.58.0-2ubuntu3.24+esm2",
        "7.58.0-2ubuntu3.24+esm3",
        "7.58.0-2ubuntu3.24+esm4",
        "7.58.0-2ubuntu3.24+esm5",
        "7.58.0-2ubuntu3.24+esm7",
        "7.58.0-2ubuntu3.24+esm8"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.68.0-1ubuntu2.25+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.68.0-1ubuntu2.25+esm4?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.68.0-1ubuntu2.25+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.65.3-1ubuntu3",
        "7.65.3-1ubuntu4",
        "7.66.0-1ubuntu1",
        "7.67.0-2ubuntu1",
        "7.68.0-1ubuntu1",
        "7.68.0-1ubuntu2",
        "7.68.0-1ubuntu2.1",
        "7.68.0-1ubuntu2.2",
        "7.68.0-1ubuntu2.4",
        "7.68.0-1ubuntu2.5",
        "7.68.0-1ubuntu2.6",
        "7.68.0-1ubuntu2.7",
        "7.68.0-1ubuntu2.10",
        "7.68.0-1ubuntu2.11",
        "7.68.0-1ubuntu2.12",
        "7.68.0-1ubuntu2.13",
        "7.68.0-1ubuntu2.14",
        "7.68.0-1ubuntu2.15",
        "7.68.0-1ubuntu2.16",
        "7.68.0-1ubuntu2.18",
        "7.68.0-1ubuntu2.19",
        "7.68.0-1ubuntu2.20",
        "7.68.0-1ubuntu2.21",
        "7.68.0-1ubuntu2.22",
        "7.68.0-1ubuntu2.23",
        "7.68.0-1ubuntu2.24",
        "7.68.0-1ubuntu2.25",
        "7.68.0-1ubuntu2.25+esm2",
        "7.68.0-1ubuntu2.25+esm3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8925",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9547",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.25"
          },
          {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.25"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.25?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.81.0-1ubuntu1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.74.0-1.3ubuntu2",
        "7.74.0-1.3ubuntu3",
        "7.80.0-3",
        "7.81.0-1",
        "7.81.0-1ubuntu1.1",
        "7.81.0-1ubuntu1.2",
        "7.81.0-1ubuntu1.3",
        "7.81.0-1ubuntu1.4",
        "7.81.0-1ubuntu1.6",
        "7.81.0-1ubuntu1.7",
        "7.81.0-1ubuntu1.8",
        "7.81.0-1ubuntu1.10",
        "7.81.0-1ubuntu1.11",
        "7.81.0-1ubuntu1.13",
        "7.81.0-1ubuntu1.14",
        "7.81.0-1ubuntu1.15",
        "7.81.0-1ubuntu1.16",
        "7.81.0-1ubuntu1.17",
        "7.81.0-1ubuntu1.18",
        "7.81.0-1ubuntu1.19",
        "7.81.0-1ubuntu1.20",
        "7.81.0-1ubuntu1.21",
        "7.81.0-1ubuntu1.22",
        "7.81.0-1ubuntu1.23",
        "7.81.0-1ubuntu1.24"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8925",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9547",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.5.0-2ubuntu10.10"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.5.0-2ubuntu10.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.5.0-2ubuntu10.10?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.0-2ubuntu10.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.2.1-1ubuntu3",
        "8.2.1-1ubuntu3.1",
        "8.4.0-2ubuntu1",
        "8.5.0-2ubuntu1",
        "8.5.0-2ubuntu2",
        "8.5.0-2ubuntu8",
        "8.5.0-2ubuntu9",
        "8.5.0-2ubuntu10",
        "8.5.0-2ubuntu10.1",
        "8.5.0-2ubuntu10.2",
        "8.5.0-2ubuntu10.3",
        "8.5.0-2ubuntu10.4",
        "8.5.0-2ubuntu10.5",
        "8.5.0-2ubuntu10.6",
        "8.5.0-2ubuntu10.7",
        "8.5.0-2ubuntu10.8",
        "8.5.0-2ubuntu10.9"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8925",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8926",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9079",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9080",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9545",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9547",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:25.10"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.4"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.14.1-2ubuntu1.4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.14.1-2ubuntu1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.12.1-3ubuntu1",
        "8.13.0-5ubuntu1",
        "8.14.1-1ubuntu2",
        "8.14.1-1ubuntu3",
        "8.14.1-2ubuntu1",
        "8.14.1-2ubuntu1.1",
        "8.14.1-2ubuntu1.2",
        "8.14.1-2ubuntu1.3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-8286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8458",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8925",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8926",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8927",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9079",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9080",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9545",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-9547",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.2"
          },
          {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "curl",
        "purl": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.18.0-1ubuntu2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.14.1-2ubuntu1",
        "8.17.0-1ubuntu1",
        "8.18.0-1ubuntu1",
        "8.18.0-1ubuntu2",
        "8.18.0-1ubuntu2.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Andrew Nesbitt discovered that curl could reuse an existing live\nconnection during STARTTLS-based connection upgrades even when the TLS\nconfiguration did not match. A remote attacker could possibly use this\nissue to cause curl to use an unintended TLS configuration.\n(CVE-2026-8286)\n\nMuhamad Arga Reksapati discovered that curl incorrectly reused\nconnections for Negotiate-authenticated requests when different services\nwere involved. A remote attacker could possibly use this issue to access\nresources authenticated for another service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-8458)\n\nIt was discovered that curl incorrectly handled cookie parsing in\ncertain circumstances. A remote attacker could possibly use this issue\nto set cookies that would be transmitted to unrelated third-party\ndomains. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and\nUbuntu 26.04 LTS. (CVE-2026-8924)\n\nJoshua Rogers discovered that curl could double-free a GSASL context\nwhen handling SASL authentication. A remote attacker could possibly use\nthis issue to cause a denial of service, or execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and\nUbuntu 26.04 LTS. (CVE-2026-8925)\n\nJoshua Rogers discovered that curl could select the wrong password from\na .netrc file when a username was specified in the URL without a\npassword. A remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 25.10 and Ubuntu\n26.04 LTS. (CVE-2026-8926)\n\nAdy Elouej discovered that curl did not clear proxy authentication\nstate between requests when reusing a handle with environment-variable\nproxy configuration. A remote attacker could possibly use this issue to\nobtain sensitive credentials. (CVE-2026-8927)\n\nGuannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li discovered\nthat curl did not properly clear proxy authentication credentials when\ninstructed to do so. A remote attacker could possibly use this issue to\nobtain sensitive credentials. This issue only affected Ubuntu 25.10 and\nUbuntu 26.04 LTS. (CVE-2026-9079)\n\nJoshua Rogers discovered that curl contained a use-after-free when\ncurl_easy_pause() was called within the event-based socket callback. A\nremote attacker could possibly use this issue to cause a denial of service\nor possibly execute arbitrary code. This issue only affected Ubuntu 25.10\nand Ubuntu 26.04 LTS. (CVE-2026-9080)\n\nEunsoo Kim discovered that curl could send early data on a resumed TLS\nsession before enforcing certificate verification failure. A\nmachine-in-the-middle attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 25.10 and Ubuntu\n26.04 LTS. (CVE-2026-9545)\n\nJoshua Rogers discovered that curl did not properly reject host key\ntype mismatches when using the SSH key callback for SCP and SFTP\ntransfers. A machine-in-the-middle attacker could possibly use this\nissue to impersonate a trusted server. This issue only affected Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.\n(CVE-2026-9547)",
  "id": "USN-8487-1",
  "modified": "2026-07-08T07:27:42Z",
  "published": "2026-06-30T21:34:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8487-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8286"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8458"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8924"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8925"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8926"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8927"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9079"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9080"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9545"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-9547"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "curl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-8286",
    "UBUNTU-CVE-2026-8458",
    "UBUNTU-CVE-2026-8924",
    "UBUNTU-CVE-2026-8925",
    "UBUNTU-CVE-2026-8926",
    "UBUNTU-CVE-2026-8927",
    "UBUNTU-CVE-2026-9079",
    "UBUNTU-CVE-2026-9080",
    "UBUNTU-CVE-2026-9545",
    "UBUNTU-CVE-2026-9547"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2026-9547

Vulnerability from osv_ubuntu

CVE-2026-9547 (GCVE-0-2026-9547)

usn-8487-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature