UBUNTU-CVE-2026-94266: Low severity ubuntu/curl vulnerability

Q: When could credentials be exposed through this issue?

Exposure can occur when an application calls curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL and receives a URL containing credentials that were not present in either the original URL or the redirected URL.

Q: How can an application determine whether it may be affected?

Review code that uses curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL, especially where the returned effective URL is logged, displayed, stored, or forwarded to other systems. The provided data does not identify affected Ubuntu curl package versions or configurations.

Published Oct 14, 2026

Updated

libcurl could accidentally return a URL for curleasygetinfo()'s CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Affected Software

5 affected componentsFixes available

ubuntu/curl<7.68.0-1ubuntu2.25+esm10

7.68.0-1ubuntu2.25+esm10

ubuntu/curl<7.81.0-1ubuntu1.30

7.81.0-1ubuntu1.30

ubuntu/curl<8.5.0-2ubuntu10.16

8.5.0-2ubuntu10.16

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 7.68.0-1ubuntu2.25+esm10
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 7.81.0-1ubuntu1.30
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.5.0-2ubuntu10.16
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

When could credentials be exposed through this issue?

Exposure can occur when an application calls curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL and receives a URL containing credentials that were not present in either the original URL or the redirected URL.

How can an application determine whether it may be affected?

Review code that uses curl_easy_getinfo() with CURLINFO_EFFECTIVE_URL, especially where the returned effective URL is logged, displayed, stored, or forwarded to other systems. The provided data does not identify affected Ubuntu curl package versions or configurations.

UBUNTU-CVE-2026-94266: Low severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

When could credentials be exposed through this issue?

How can an application determine whether it may be affected?

Company

Resources

Contact

Frequently Asked Questions

When could credentials be exposed through this issue?

How can an application determine whether it may be affected?