UBUNTU-CVE-2026-86414: Low severity ubuntu/curl vulnerability
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.35.0-1ubuntu2.20+esm24 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.47.0-1ubuntu2.19+esm21 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.58.0-2ubuntu3.24+esm15 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to control or operate an HTTP proxy used by the affected libcurl client. The proxy must respond to a CONNECT tunnel request with a 401 response containing WWW-Authenticate rather than the expected 407 Proxy-Authenticate response.
Which credentials could be disclosed to the proxy?
The proxy may receive the origin server's Basic authentication password or a Negotiate/Kerberos ticket. The issue concerns credentials that libcurl should send to the origin, not the proxy.
Are clients that do not use an HTTP proxy exposed?
The described attack depends on an HTTP proxy handling a CONNECT tunnel request. Clients not using such a proxy are not exposed through this attack path.