Ubuntu 14.04 LTS curl Important Regression Security Issues USN-8487

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

USN-8487-1 introduced a regression in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: USN-8487-1 fixed vulnerabilities in curl. Unfortunately that update contained an incomplete fix for CVE-2026-8927. This update fixes the problem. Original advisory details: Andrew Nesbitt discovered that curl could reuse an existing live connection during STARTTLS-based connection upgrades even when the TLS configuration did not match. A remote attacker could possibly use this issue to cause curl to use an unintended TLS configuration. (CVE-2026-8286) Muhamad Arga Reksapati discovered that curl incorrectly reused connections for Negotiate-authenticated requests when different services were involved. A remote attacker could possibly use this issue to access resources authenticated for another service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE... Read the Full Advisory

USN-8487-1 introduced a regression in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

USN-8487-1 fixed vulnerabilities in curl. Unfortunately that update

contained an incomplete fix for CVE-2026-8927. This update fixes the

Original advisory details:

Andrew Nesbitt discovered that curl could reuse an existing live

connection during STARTTLS-based connection upgrades even when the TLS

configuration did not match. A remote attacker could possibly use this

issue to cause curl to use an unintended TLS configuration.

Muhamad Arga Reksapati discovered that curl incorrectly reused connections

for Negotiate-authenticated requests when different services were

involved. A remote attacker could possibly use this issue to access

resources authenticated for another service. This issue only affected

Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,

Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE...

The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS curl 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl3 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl3-gnutls 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl3-nss 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl4-gnutls-dev 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl4-nss-dev 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro libcurl4-openssl-dev 7.35.0-1ubuntu2.20+esm23 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8487-2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases