Ubuntu Fixes curl Security Flaws: How to Update Now

The short version: Ubuntu has shipped fixed curl packages for a batch of curl security bugs that the curl project disclosed on 14 October 2026. One of them, CVE-2026-92392, is rated high and can lead to remote code execution, but it only hits Ubuntu 26.04 LTS and Ubuntu 26.10. The rest are low severity. For most desktop users, a normal system update is all it takes.

What is curl, and why should you care?

A tiny tool that is everywhere: curl is a program for downloading and sending data over the internet, using protocols like HTTP, HTTPS and FTP. You can run it yourself in a terminal, and many install guides (including ours) use it to fetch files and scripts.

The library matters even more: curl also comes as a library called libcurl. Lots of other programs on your PC use libcurl behind the scenes whenever they need to talk to a server. So a bug in curl is not just a bug in one command. It can affect any app that relies on the library, which is why Ubuntu treats these updates seriously.

What was fixed

A coordinated release: on 7 October 2026, curl maintainer Daniel Stenberg announced that a new curl release on 14 October would fix a large batch of security issues. Ubuntu and other vendors got the details early under embargo, so fixes were ready on disclosure day. Ubuntu’s announcement lists 24 CVE identifiers in total.

Ubuntu’s notices: Ubuntu published USN-8927-1 (Ubuntu 26.04 LTS, 18 CVEs) and USN-8932-1 (Ubuntu 24.04 LTS down to 14.04 LTS, 9 CVEs) on 14 October. Ubuntu 26.10 followed with USN-8927-2 on 19 October. The remaining CVEs only affect newer curl versions or TLS backends that Ubuntu’s packages do not use.

The high-severity bug: CVE-2026-92392

What goes wrong: while curl is uploading data over HTTP/2, a server can answer with a special “reset stream” message. curl mishandles that reply and keeps using memory it has already freed. This kind of bug is called a use-after-free.

How bad it is: Ubuntu’s security team scored it 8.1 out of 10 (high) and says it is known to allow remote code execution. The good news: an attacker needs you to connect to a malicious server, and Ubuntu describes the conditions needed to exploit it as complex. Upstream, the bug exists in curl 8.12.0 through 8.22.0, which is why only Ubuntu 26.04 LTS and 26.10 are affected.

The low-severity bugs

A mixed bag: the other fixes cover leaking passwords or Kerberos tickets to the wrong server or proxy, HTTPS security (HSTS) entries being dropped, SSH host key checks that could be skipped, malicious servers wiping or breaking cookie files, TFTP and IMAP protocol confusion, and crashes or hangs that cause a denial of service.

One more use-after-free: CVE-2026-92388 is in the same bug class as the high one, but it only matters for apps that use libcurl’s FTP wildcard feature in a certain way. It does not affect the curl command itself, so the curl project rated it low.

Which Ubuntu releases are affected

Every release from 14.04 LTS to 26.10 got a curl update. These fixed versions come from Ubuntu’s security notices. If your installed version is the same or newer, you are protected.

Same version for the libraries: the libcurl packages on each release (such as libcurl4t64 on 24.04 and newer, or libcurl4 on 22.04 and older) get the same version number as curl.

Step 1: Install the update

Recommended: open a terminal and upgrade all packages. This picks up the curl fixes along with any other pending security updates. Our apt and snap commands guide explains what each part does.

sudo apt update && sudo apt upgrade

Targeted option: if you cannot upgrade everything right now, Ubuntu suggests updating only the packages built from curl:

sudo apt update && sudo apt install --only-upgrade '?source-package(^curl$)'

Restart your apps: programs that were already running keep the old library loaded in memory. Close and reopen them after updating, or simply reboot to be sure.

Step 2: Check your installed version

This command from Ubuntu’s announcement lists every installed package that comes from curl, with its version. Compare the numbers with the table above:

apt list '?installed ?source-package(^curl$)'

Prefer apt policy? This shows the installed and available version of curl and its library. On Ubuntu 22.04 and older, replace libcurl4t64 with libcurl4:

apt policy curl libcurl4t64

Quick check of the curl command: curl --version shows the upstream version (for example 8.5.0 on Ubuntu 24.04). It does not show Ubuntu’s patch number, so use one of the commands above to confirm you have the fix.

Automatic updates and Ubuntu Pro

You may already be patched: unattended-upgrades is turned on by default since Ubuntu 16.04 LTS and installs new security updates every 24 hours. If you have not changed that setting, the curl fix was likely installed within a day of release. Running the commands above does no harm either way.

Standard support: Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS get these fixes through the normal update channels.

Older LTS releases: Ubuntu 20.04 LTS and older receive the fix through Expanded Security Maintenance (ESM), part of Ubuntu Pro. Ubuntu 16.04 LTS and 14.04 LTS also need the Legacy Support add-on. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for Ubuntu community members.

Other recent fixes: October has been busy for Ubuntu security. If you missed them, see our guides to the eMudhra CA certificates fix and the php2shell PHP vulnerability fix.

Bottom line

The only serious bug in this batch hits Ubuntu 26.04 LTS and 26.10, and it needs a malicious server and tricky conditions to exploit. Still, curl is built into so much of your system that it is worth updating now. Run a system update, check that your curl version matches the table, and restart your apps.

Source: Ubuntu blog.