UBUNTU-CVE-2026-107929: Low severity ubuntu/curl vulnerability

Q: Are transfers using the default network-interface selection affected?

The issue is described only when CURLOPT_INTERFACE or --interface is set with one of the prefixes if!, host!, or ifhost!. Transfers that do not use those prefixed forms are not identified as affected.

Q: What conditions are needed for the incorrect source address to be used?

A client must reuse an existing connection after an earlier transfer, then request a different source binding using one of the documented prefixes. Because that binding is omitted from the connection reuse key, the later transfer can use the earlier connection's source address.

Q: How can I identify potentially affected usage?

Review applications and curl command invocations for CURLOPT_INTERFACE or --interface values beginning with if!, host!, or ifhost!. Pay particular attention to clients that perform multiple transfers and reuse connections while changing the requested source binding.

Published Oct 14, 2026

Updated

When CURLOPTINTERFACE (or the command line tool's --interface option) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address

Affected Software

2 affected componentsFixes available

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are transfers using the default network-interface selection affected?

The issue is described only when CURLOPT_INTERFACE or --interface is set with one of the prefixes if!, host!, or ifhost!. Transfers that do not use those prefixed forms are not identified as affected.

What conditions are needed for the incorrect source address to be used?

A client must reuse an existing connection after an earlier transfer, then request a different source binding using one of the documented prefixes. Because that binding is omitted from the connection reuse key, the later transfer can use the earlier connection's source address.

How can I identify potentially affected usage?

Review applications and curl command invocations for CURLOPT_INTERFACE or --interface values beginning with if!, host!, or ifhost!. Pay particular attention to clients that perform multiple transfers and reuse connections while changing the requested source binding.

UBUNTU-CVE-2026-107929: Low severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Are transfers using the default network-interface selection affected?

What conditions are needed for the incorrect source address to be used?

How can I identify potentially affected usage?

Company

Resources

Contact

Frequently Asked Questions

Are transfers using the default network-interface selection affected?

What conditions are needed for the incorrect source address to be used?

How can I identify potentially affected usage?