Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-86409: curl can be tricked into running malicious code
CVE-2026-86409 · published today
Summary
The curl command‑line tool used on several Linux distributions (including Debian, Ubuntu and Alpine) has a flaw that could let an attacker run code on your server when curl processes a crafted request. Updating curl to the latest released version resolves the issue and prevents possible compromise.
What to do
- Update debian curl to version 8.22.0-1.
- Update canonical curl to version 8.18.0-1ubuntu2.8.
- Update canonical curl to version 8.20.0-2ubuntu11.1.
- Update canonical curl to version 7.81.0-1ubuntu1.30.
- Update canonical curl to version 8.5.0-2ubuntu10.16.
- Update curl to version 8.23.0-r0.
- Update bellsoft curl to version 8.22.0-r0.
- Update curl to version 8.22.0-r0.
- Update curl to version 7.88.1-10+deb12u15.aikido.18.
- Update rootio-curl to version 7.88.1-10+deb12u15.aikido.18.
- Update curl to version 8.14.1-2+deb13u7.aikido.25.
- Update rootio-curl to version 8.14.1-2+deb13u7.aikido.25.
- Update curl to version 8.14.1-r300712.
- Update rootio-curl to version 8.14.1-r300712.
- Update curl to version 7.88.1-10+deb12u15.aikido.19.
- Update rootio-curl to version 7.88.1-10+deb12u15.aikido.19.
- Update curl to version 7.88.1-10+deb12u15.aikido.20.
- Update rootio-curl to version 7.88.1-10+deb12u15.aikido.20.
- Update curl to version 8.5.0-r00075.
- Update rootio-curl to version 8.5.0-r00075.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | curl | All versions |
| Debian:14 | debian | curl |
< 8.22.0-1 Fix: upgrade to 8.22.0-1
|
| Ubuntu:22.04:LTS | canonical | curl |
< 7.81.0-1ubuntu1.30 Fix: upgrade to 7.81.0-1ubuntu1.30
|
| Ubuntu:26.04:LTS | canonical | curl |
< 8.18.0-1ubuntu2.8 Fix: upgrade to 8.18.0-1ubuntu2.8
|
| – | curl | curl | <= 8.21.0 |
| Ubuntu:26.10 | canonical | curl |
< 8.20.0-2ubuntu11.1 Fix: upgrade to 8.20.0-2ubuntu11.1
|
| Ubuntu:24.04:LTS | canonical | curl |
< 8.5.0-2ubuntu10.16 Fix: upgrade to 8.5.0-2ubuntu10.16
|
| Alpine:v3.23 | – | curl |
< 8.23.0-r0 Fix: upgrade to 8.23.0-r0
|
| Alpaquita:23 | bellsoft | curl |
>= 8.1.0-r2, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| Alpaquita:25 | bellsoft | curl |
>= 8.14.0-r1, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| Alpaquita:stream | bellsoft | curl |
>= 8.1.2-r0, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| BellSoft Hardened Containers:stream | – | curl |
>= 8.1.2-r0, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| Root:Debian:12 | – | curl |
< 7.88.1-10+deb12u15.aikido.18 < 7.88.1-10+deb12u15.aikido.19 < 7.88.1-10+deb12u15.aikido.20 Fix: upgrade to 7.88.1-10+deb12u15.aikido.18
|
| Root:Debian:12 | – | rootio-curl |
< 7.88.1-10+deb12u15.aikido.18 < 7.88.1-10+deb12u15.aikido.19 < 7.88.1-10+deb12u15.aikido.20 Fix: upgrade to 7.88.1-10+deb12u15.aikido.18
|
| Root:Debian:13 | – | curl |
< 8.14.1-2+deb13u7.aikido.25 Fix: upgrade to 8.14.1-2+deb13u7.aikido.25
|
| Root:Debian:13 | – | rootio-curl |
< 8.14.1-2+deb13u7.aikido.25 Fix: upgrade to 8.14.1-2+deb13u7.aikido.25
|
| Root:Alpine:3.21 | – | curl |
< 8.14.1-r300712 Fix: upgrade to 8.14.1-r300712
|
| Root:Alpine:3.21 | – | rootio-curl |
< 8.14.1-r300712 Fix: upgrade to 8.14.1-r300712
|
| Root:Alpine:3.15 | – | curl |
< 8.5.0-r00075 Fix: upgrade to 8.5.0-r00075
|
| Root:Alpine:3.15 | – | rootio-curl |
< 8.5.0-r00075 Fix: upgrade to 8.5.0-r00075
|
Original advisory text
CVE-2026-86409 in curl - Patched by Root
Root has patched CVE-2026-86409 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.
References
- https://ubuntu.com/security/notices/USN-8927-2 Vendor Advisory
- https://curl.se/docs/CVE-2026-86409.json
- https://hackerone.com/reports/3973135
- https://curl.se/docs/CVE-2026-86409.html Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-86409 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-86409 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-86409 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8927-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8932-1 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-86409 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-86409 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.1
High
Type
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CURL-CVE-2026-86409 · OSV
CVE-2026-86409 · NVD
DEBIAN-CVE-2026-86409 · OSV
UBUNTU-CVE-2026-86409 · OSV
CVE-2026-86409 · MITRE
ALPINE-CVE-2026-86409 · OSV
BELL-CVE-2026-86409 · OSV
Track software like this
Free during beta