Update for July 9, 2026: Ubuntu published USN-8525-1 for curl and libcurl. This updates the existing FixItPhill curl hosting checklist rather than creating a duplicate article, because the same practical issue is still in front of admins: curl is buried inside backup jobs, deployment tools, API workers, monitoring, control-panel adjacent scripts, containers, and ordinary server maintenance.
Ubuntu says USN-8525-1 fixes several curl security issues across Ubuntu 26.04 LTS, 25.10, 24.04 LTS, 20.04 LTS, 18.04 LTS, 16.04 LTS, and 14.04 LTS, depending on the specific CVE. The most important hosting takeaway is that the fixed issues include credential handling mistakes, connection reuse problems, SSH trust verification mistakes, denial-of-service risks, and one HTTP/2 memory-safety issue that Ubuntu describes as potentially leading to arbitrary code execution.
What changed in USN-8525-1
USN-8525-1 lists these CVEs for curl/libcurl:
- CVE-2024-11053 – credential handling with redirects and .netrc files on older Ubuntu releases.
- CVE-2024-8096 – OCSP stapling handling on older Ubuntu releases.
- CVE-2026-10536 – HTTP/2 stream handle cleanup memory-safety issue affecting Ubuntu 24.04 LTS, 25.04, and 25.10.
- CVE-2026-5545 – connection reuse when switching authentication methods to the same host on Ubuntu 20.04 LTS.
- CVE-2026-5773 – SMB connection reuse when the target share differs on Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS.
- CVE-2026-7168 – Digest proxy authentication credential handling on Ubuntu 18.04 LTS and 20.04 LTS.
- CVE-2026-12064 – SSH host verification behavior when schemeless URLs use a default protocol on Ubuntu 25.04 and 25.10.
- CVE-2026-11586 – WebSocket memory exhaustion risk on Ubuntu 25.10.
- CVE-2026-11352 – HTTP/3 handling that can lead to a denial-of-service condition on Ubuntu 25.10.
- CVE-2026-11564 – CA trust handling after switching a handle to custom CA material on Ubuntu 25.10.
The exact fixed package version depends on the Ubuntu release. Use Ubuntu’s package table in USN-8525-1 as the source of truth for the build numbers you should see after updating.
Who should patch first
- Ubuntu servers that run deployment, backup, monitoring, CDN/origin checks, billing, webhook, or API automation that uses curl or libcurl.
- Hosting providers with Ubuntu-based worker nodes, jump boxes, build agents, migration tooling, or customer-maintenance scripts.
- WordPress and WooCommerce operators whose site infrastructure depends on external API jobs outside the WordPress dashboard.
- Container users whose images include curl or libcurl. Updating the host does not automatically update already-built application images.
- Older Ubuntu systems covered by Ubuntu Pro or ESM, because several issues in this notice apply to older supported tracks.
Safe update path
- Take a current backup or snapshot first, especially on shared hosting, billing, DNS, mail, or backup infrastructure.
- Apply the current Ubuntu security updates from the normal Ubuntu repository, Ubuntu Pro, or ESM path used by that server.
- Confirm that the installed curl and libcurl package versions match Ubuntu’s fixed build for that release.
- Restart or recycle long-running services that load libcurl, such as queue workers, backup agents, API workers, monitoring daemons, panel integrations, and application services.
- Rebuild and redeploy containers that include curl or libcurl in the image.
- After the update, run normal maintenance checks: package status, service health, outbound API jobs, backup jobs, monitoring jobs, and any automation that relies on SSH, HTTPS, HTTP/2, HTTP/3, WebSocket, SMB, or proxy flows.
What to watch after patching
Most sites will not need application-code changes. The risk is operational drift: a service might keep an older libcurl in memory, a container might still be based on an older image, or an automation host might be outside the normal patch cycle. Treat curl updates as both a package update and an inventory check.
For hosting environments, pay special attention to backup agents, API polling jobs, deployment hooks, CDN purge integrations, uptime checks, payment/webhook helpers, and migration tooling. These are the places where curl and libcurl are commonly used without anyone thinking of them as a direct dependency.
Existing USN-8487-1 coverage still matters
This article originally covered USN-8487-1, which fixed a different curl/libcurl batch including CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-9079, CVE-2026-9080, CVE-2026-9545, and CVE-2026-9547. If you skipped the July 1 curl update window, do not treat USN-8525-1 as the only item to check. Bring the server fully current.
Sources
FixItPhill note: This guidance is defensive. It stays at source-confirmed impact, affected package families, and maintenance steps. The action path is backup first, update through Ubuntu’s supported package channel, restart dependent services, rebuild containers, and verify normal jobs afterward.
