UBUNTU-CVE-2026-8925

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-8925

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8925.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-8925

Upstream

CVE-2026-8925

Downstream

USN-8487-1

Related

USN-8487-1

Published

2026-06-24T14:00:00Z

Modified

2026-07-02T22:49:53.966071903Z

Severity

Ubuntu - medium

Summary

[none]

Details

The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice.

References

Affected packages

Ubuntu:22.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.81.0-1ubuntu1.25

Affected versions

7.*

7.74.0-1.3ubuntu2

7.74.0-1.3ubuntu3

7.80.0-3

7.81.0-1

7.81.0-1ubuntu1.1

7.81.0-1ubuntu1.2

7.81.0-1ubuntu1.3

7.81.0-1ubuntu1.4

7.81.0-1ubuntu1.6

7.81.0-1ubuntu1.7

7.81.0-1ubuntu1.8

7.81.0-1ubuntu1.10

7.81.0-1ubuntu1.11

7.81.0-1ubuntu1.13

7.81.0-1ubuntu1.14

7.81.0-1ubuntu1.15

7.81.0-1ubuntu1.16

7.81.0-1ubuntu1.17

7.81.0-1ubuntu1.18

7.81.0-1ubuntu1.19

7.81.0-1ubuntu1.20

7.81.0-1ubuntu1.21

7.81.0-1ubuntu1.22

7.81.0-1ubuntu1.23

7.81.0-1ubuntu1.24

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "curl",
            "binary_version": "7.81.0-1ubuntu1.25"
        },
        {
            "binary_name": "libcurl3-gnutls",
            "binary_version": "7.81.0-1ubuntu1.25"
        },
        {
            "binary_name": "libcurl3-nss",
            "binary_version": "7.81.0-1ubuntu1.25"
        },
        {
            "binary_name": "libcurl4",
            "binary_version": "7.81.0-1ubuntu1.25"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8925.json"

Ubuntu:24.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.5.0-2ubuntu10.10

Affected versions

8.*

8.2.1-1ubuntu3

8.2.1-1ubuntu3.1

8.4.0-2ubuntu1

8.5.0-2ubuntu1

8.5.0-2ubuntu2

8.5.0-2ubuntu8

8.5.0-2ubuntu9

8.5.0-2ubuntu10

8.5.0-2ubuntu10.1

8.5.0-2ubuntu10.2

8.5.0-2ubuntu10.3

8.5.0-2ubuntu10.4

8.5.0-2ubuntu10.5

8.5.0-2ubuntu10.6

8.5.0-2ubuntu10.7

8.5.0-2ubuntu10.8

8.5.0-2ubuntu10.9

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "curl",
            "binary_version": "8.5.0-2ubuntu10.10"
        },
        {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.5.0-2ubuntu10.10"
        },
        {
            "binary_name": "libcurl4t64",
            "binary_version": "8.5.0-2ubuntu10.10"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8925.json"

Ubuntu:25.10 / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.14.1-2ubuntu1.4

Affected versions

8.*

8.12.1-3ubuntu1

8.13.0-5ubuntu1

8.14.1-1ubuntu2

8.14.1-1ubuntu3

8.14.1-2ubuntu1

8.14.1-2ubuntu1.1

8.14.1-2ubuntu1.2

8.14.1-2ubuntu1.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "curl",
            "binary_version": "8.14.1-2ubuntu1.4"
        },
        {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.14.1-2ubuntu1.4"
        },
        {
            "binary_name": "libcurl4t64",
            "binary_version": "8.14.1-2ubuntu1.4"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8925.json"

Ubuntu:26.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.18.0-1ubuntu2.2

Affected versions

8.*

8.14.1-2ubuntu1

8.17.0-1ubuntu1

8.18.0-1ubuntu1

8.18.0-1ubuntu2

8.18.0-1ubuntu2.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "curl",
            "binary_version": "8.18.0-1ubuntu2.2"
        },
        {
            "binary_name": "libcurl3t64-gnutls",
            "binary_version": "8.18.0-1ubuntu2.2"
        },
        {
            "binary_name": "libcurl4t64",
            "binary_version": "8.18.0-1ubuntu2.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8925.json"