USN-8927-1: curl vulnerabilities

Summary by Cyber Security News14 Oct 2026, 13:58 CEST

About this summary. This is a short, independently written summary of an article first published by Ubuntu Security. Cyber Security News did not report or verify the underlying story. Read the original: https://ubuntu.com/security/notices/USN-8927-1

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used.

Read the full article at Ubuntu Security →

Source attribution: headline and facts are from Ubuntu Security (ubuntu.com). Summary method: excerpt of the source description. See our source attribution policy.