USN-8670-2: curl vulnerability

unknownpublic exploitCVE-2026-8932

USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations.

CSIRTS triage

vendor: curl product: curl Authentication bypass

What: curl incorrectly reused client certificates across connections when certificate settings changed, potentially sending the wrong certificate to a server.
Who is affected: All curl users relying on certificate-based authentication across multiple connections.
Urgency: Moderate; the vulnerability allows authentication bypass through certificate misuse, but requires specific connection reuse scenarios.
Action: Update curl to the patched version provided in USN-8670-2 for affected Ubuntu LTS releases.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch curl

Get an email when a new curl advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-25
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8670-2

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-89320.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-8932	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] cURL: Multiple vulnerabilitiescert-bund
unknownUSN-8670-1: curl vulnerabilityubuntu
unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
highCVE-2026-8932: incomplete mTLS config matching in conn reusemsrc
highCVE-2026-8932: libcurl would reuse a previously created connection even when some mTLS config related option h…nvd
unknownMultiple vulnerabilities in cURL and libcurl (June 24, 2026)cert-fr-avis