UBUNTU-CVE-2026-86410: Low severity ubuntu/curl vulnerability

Q: When is this issue triggered?

It is triggered when the curl command-line tool follows a redirect to an SFTP or SCP destination. Direct SFTP or SCP use sets the SSH host verification options as intended.

Q: What security check may be missing during an affected redirected transfer?

SSH host verification options may not be set when the SFTP or SCP connection results from a redirect. This can weaken verification of the SSH host for that redirected connection.

Published Oct 14, 2026

Updated

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

Affected Software

2 affected componentsFixes available

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

When is this issue triggered?

It is triggered when the curl command-line tool follows a redirect to an SFTP or SCP destination. Direct SFTP or SCP use sets the SSH host verification options as intended.

What security check may be missing during an affected redirected transfer?

SSH host verification options may not be set when the SFTP or SCP connection results from a redirect. This can weaken verification of the SSH host for that redirected connection.

UBUNTU-CVE-2026-86410: Low severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

When is this issue triggered?

What security check may be missing during an affected redirected transfer?

Company

Resources

Contact

Frequently Asked Questions

When is this issue triggered?

What security check may be missing during an affected redirected transfer?