UBUNTU-CVE-2026-86409: Low severity ubuntu/curl vulnerability

Q: Who is exposed to this issue?

Applications using Ubuntu's curl package that reuse the same handle for multiple transfers and configure CURLOPT_AWS_SIGV4 are exposed. The problem occurs when the application later sets CURLOPT_AWS_SIGV4 to NULL and expects SigV4 authentication to be disabled.

Q: What must happen for the authorization header to be sent unexpectedly?

A transfer using SigV4 must be followed by another transfer on the same handle after CURLOPT_AWS_SIGV4 has been set to NULL. The subsequent request can still include an Authorization: AWS4-HMAC-SHA256 header for the next URL.

Q: How can I determine whether an application is affected?

Review code and request traces for reused curl handles where CURLOPT_AWS_SIGV4 is set for one transfer and then reset to NULL before a later transfer. Check whether the later request still sends an Authorization: AWS4-HMAC-SHA256 header.

Published Oct 14, 2026

Updated

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information.

Affected Software

4 affected componentsFixes available

ubuntu/curl<7.81.0-1ubuntu1.30

7.81.0-1ubuntu1.30

ubuntu/curl<8.5.0-2ubuntu10.16

8.5.0-2ubuntu10.16

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 7.81.0-1ubuntu1.30
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.5.0-2ubuntu10.16
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using Ubuntu's curl package that reuse the same handle for multiple transfers and configure CURLOPT_AWS_SIGV4 are exposed. The problem occurs when the application later sets CURLOPT_AWS_SIGV4 to NULL and expects SigV4 authentication to be disabled.

What must happen for the authorization header to be sent unexpectedly?

A transfer using SigV4 must be followed by another transfer on the same handle after CURLOPT_AWS_SIGV4 has been set to NULL. The subsequent request can still include an Authorization: AWS4-HMAC-SHA256 header for the next URL.

How can I determine whether an application is affected?

Review code and request traces for reused curl handles where CURLOPT_AWS_SIGV4 is set for one transfer and then reset to NULL before a later transfer. Check whether the later request still sends an Authorization: AWS4-HMAC-SHA256 header.

UBUNTU-CVE-2026-86409: Low severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must happen for the authorization header to be sent unexpectedly?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must happen for the authorization header to be sent unexpectedly?

How can I determine whether an application is affected?