USN-8525-1: curl vulnerabilities

unknownCVE-2024-11053 CVE-2024-8096 CVE-2026-10536 CVE-2026-5545 CVE-2026-5773 CVE-2026-7168

Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053) Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-8096) Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2026-10536) Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication methods to the same host. An attacker could possibly use this issue to obtain sensitive information or perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545) Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773) Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168) It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks. This issue only affected Ubuntu 25.04 and Ubunt

CSIRTS triage

vendor: curl product: curl Information disclosure Denial of serviceOtheraffected: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, Ubuntu 25.10

What: curl has several vulnerabilities that could lead to information disclosure or denial of service.
Who is affected: Affected deployments include Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 24.04 LTS, 25.04, and 25.10.
Urgency: Remediation is urgent due to the potential for sensitive information exposure and denial of service.
Action: Update to the latest version of curl.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch curl

Get an email when a new curl advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8525-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2024-110531.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all scored CVEs.
Low exploitation riskCVE-2024-80960.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
Low exploitation riskCVE-2026-105360.89% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all scored CVEs.
Low exploitation riskCVE-2026-55450.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
Low exploitation riskCVE-2026-57730.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.
Low exploitation riskCVE-2026-71680.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
Low exploitation riskCVE-2026-120640.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
Low exploitation riskCVE-2026-115860.86% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all scored CVEs.
Moderate exploitation riskCVE-2026-113521.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 59% of all scored CVEs.
Low exploitation riskCVE-2026-115640.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-11053	coverage & exploitation status	NVD · CVE.org
CVE-2024-8096	coverage & exploitation status	NVD · CVE.org
CVE-2026-10536	coverage & exploitation status	NVD · CVE.org
CVE-2026-5545	coverage & exploitation status	NVD · CVE.org
CVE-2026-5773	coverage & exploitation status	NVD · CVE.org
CVE-2026-7168	coverage & exploitation status	NVD · CVE.org
CVE-2026-12064	coverage & exploitation status	NVD · CVE.org
CVE-2026-11586	coverage & exploitation status	NVD · CVE.org
CVE-2026-11352	coverage & exploitation status	NVD · CVE.org
CVE-2026-11564	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.