Skip to content
Critical Curl Vulnerabilities in Ubuntu Fixed with USN-8487-2

Critical Curl Vulnerabilities in Ubuntu Fixed with USN-8487-2

First seen 29 Sep 2026, 03:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 29, 2026 at 05:09 UTC
  • •USN-8487-2 fixes critical vulnerabilities in curl affecting multiple Ubuntu versions.
  • •CVE-2026-8927 had an incomplete fix in the prior update, allowing potential exploitation.
  • •Remote attackers could misuse connection reuse and cookie parsing flaws to access unauthorized data.

The USN-8487-2 update addresses critical vulnerabilities in curl, particularly an incomplete fix for CVE-2026-8927 from the previous USN-8487-1. The vulnerabilities allow remote attackers to exploit connection reuse during STARTTLS upgrades and Negotiate-authenticated requests, potentially accessing unauthorized resources. Affected systems include Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. The update also resolves issues related to cookie parsing that could lead to cookie leakage to third-party domains. Users are advised to update their systems to mitigate these risks. The vulnerabilities were initially disclosed on July 3, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-03
CVE-2026-8927 published
CVE-2026-8927 was disclosed, detailing vulnerabilities in curl related to connection reuse.
Ubuntu
2026-07-03
CVE-2026-9545 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-9547 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-9079 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-8924 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-9080 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-8458 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-8286 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-8925 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-03
CVE-2026-8926 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (3)

Following this threat?

Track Ubuntu and CVE-2026-8286 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3