Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-9079: curl may run malicious code on several Linux systems
CVE-2026-9079 · published 2 months ago
Summary
The curl program in Alpine, Canonical, Debian and BellSoft packages has a flaw that could let an attacker cause it to execute unwanted code. This could compromise the security of the server that uses curl. Update curl to the newest version provided by your distribution as soon as possible.
What to do
- Update alpine curl to version 8.14.1-r20073.
- Update canonical curl to version 8.14.1-2ubuntu1.4.
- Update canonical curl to version 8.18.0-1ubuntu2.2.
- Update bellsoft curl to version 8.21.0-r0.
- Update debian curl to version 8.21.0~rc2-1.
- Update alpine curl to version 8.19.0-r00074.
- Update alpine rootio-curl to version 8.19.0-r00074.
- Update alpine rootio-curl to version 8.14.1-r20073.
- Update alpine curl to version 8.14.1-r20074.
- Update alpine rootio-curl to version 8.14.1-r20074.
- Update alpine curl to version 8.14.1-r20078.
- Update alpine rootio-curl to version 8.14.1-r20078.
- Update alpine curl to version 8.19.0-r00076.
- Update alpine rootio-curl to version 8.19.0-r00076.
- Update debian rootio-curl to version 8.14.1-2+deb13u4.root.io.13.
- Update debian rootio-curl to version 8.14.1-2+deb13u4.aikido.14.
- Update debian curl to version 8.14.1-2+deb13u4.aikido.14.
- Update curl to version 8.14.1-r20079.
- Update rootio-curl to version 8.14.1-r20079.
- Update curl to version 8.14.1-2+deb13u5.aikido.18.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.18.
- Update curl to version 8.14.1-2+deb13u5.aikido.19.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.19.
- Update curl to version 8.14.1-r30075.
- Update rootio-curl to version 8.14.1-r30075.
- Update curl to version 8.14.1-r30076.
- Update rootio-curl to version 8.14.1-r30076.
- Update curl to version 8.14.1-r200710.
- Update rootio-curl to version 8.14.1-r200710.
- Update curl to version 8.14.1-r20074.
- Update rootio-curl to version 8.14.1-r20074.
- Update curl to version 8.14.1-r200711.
- Update rootio-curl to version 8.14.1-r200711.
- Update curl to version 8.14.1-r30077.
- Update rootio-curl to version 8.14.1-r30077.
- Update curl to version 8.14.1-r20075.
- Update rootio-curl to version 8.14.1-r20075.
- Update curl to version 8.14.1-2+deb13u5.aikido.20.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.20.
- Update curl to version 8.14.1-r30079.
- Update rootio-curl to version 8.14.1-r30079.
- Update curl to version 8.14.1-r20076.
- Update rootio-curl to version 8.14.1-r20076.
- Update curl to version 8.14.1-r200712.
- Update rootio-curl to version 8.14.1-r200712.
- Update curl to version 8.14.1-2+deb13u5.aikido.21.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.21.
- Update curl to version 8.22.0-r0.
- Update curl to version 8.21.0-r0.
- Update curl to version 8.14.1-r20077.
- Update rootio-curl to version 8.14.1-r20077.
- Update curl to version 8.14.1-2+deb13u5.aikido.22.
- Update rootio-curl to version 8.14.1-2+deb13u5.aikido.22.
- Update curl to version 8.19.0-r00076.
- Update rootio-curl to version 8.19.0-r00076.
- Update haxx curl to version 8.21.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:Alpine:3.21 | alpine | curl |
< 8.14.1-r20073 Fix: upgrade to 8.14.1-r20073
|
| Ubuntu:25.10 | canonical | curl |
< 8.14.1-2ubuntu1.4 Fix: upgrade to 8.14.1-2ubuntu1.4
|
| Ubuntu:26.04:LTS | canonical | curl |
< 8.18.0-1ubuntu2.2 Fix: upgrade to 8.18.0-1ubuntu2.2
|
| – | curl | curl |
<= 8.20.0 < 8.14.2 < 88c7e16cceec816a2df45c899d49b1e85513f193 8.20.0 |
| Alpaquita:stream | bellsoft | curl |
>= 8.1.2-r0, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Debian:14 | debian | curl |
< 8.21.0~rc2-1 Fix: upgrade to 8.21.0~rc2-1
|
| Debian:13 | debian | curl | All versions |
| Root:Alpine:3.23 | alpine | curl |
< 8.19.0-r00074 < 8.19.0-r00076 Fix: upgrade to 8.19.0-r00074
|
| Root:Alpine:3.23 | alpine | rootio-curl |
< 8.19.0-r00074 < 8.19.0-r00076 Fix: upgrade to 8.19.0-r00074
|
| Root:Alpine:3.22 | alpine | curl |
< 8.14.1-r20073 < 8.14.1-r20074 Fix: upgrade to 8.14.1-r20073
|
| Root:Alpine:3.22 | alpine | rootio-curl |
< 8.14.1-r20073 < 8.14.1-r20074 Fix: upgrade to 8.14.1-r20073
|
| BellSoft Hardened Containers:stream | bellsoft | curl |
>= 8.1.2-r0, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Root:Alpine:3.20 | alpine | curl |
< 8.14.1-r20078 Fix: upgrade to 8.14.1-r20078
|
| Root:Alpine:3.20 | alpine | rootio-curl |
< 8.14.1-r20078 Fix: upgrade to 8.14.1-r20078
|
| Root:Alpine:3.21 | alpine | rootio-curl |
< 8.14.1-r20073 Fix: upgrade to 8.14.1-r20073
|
| Root:Debian:13 | debian | rootio-curl |
< 8.14.1-2+deb13u4.root.io.13 < 8.14.1-2+deb13u4.aikido.14 Fix: upgrade to 8.14.1-2+deb13u4.root.io.13
|
| Root:Debian:13 | debian | curl |
< 8.14.1-2+deb13u4.aikido.14 Fix: upgrade to 8.14.1-2+deb13u4.aikido.14
|
| Root:Alpine:3.20 | – | curl |
< 8.14.1-r20079 < 8.14.1-r200710 < 8.14.1-r200711 < 8.14.1-r200712 Fix: upgrade to 8.14.1-r20079
|
| Root:Alpine:3.20 | – | rootio-curl |
< 8.14.1-r20079 < 8.14.1-r200710 < 8.14.1-r200711 < 8.14.1-r200712 Fix: upgrade to 8.14.1-r20079
|
| Root:Debian:13 | – | curl |
< 8.14.1-2+deb13u5.aikido.18 < 8.14.1-2+deb13u5.aikido.19 < 8.14.1-2+deb13u5.aikido.20 < 8.14.1-2+deb13u5.aikido.21 < 8.14.1-2+deb13u5.aikido.22 Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
|
| Root:Debian:13 | – | rootio-curl |
< 8.14.1-2+deb13u5.aikido.18 < 8.14.1-2+deb13u5.aikido.19 < 8.14.1-2+deb13u5.aikido.20 < 8.14.1-2+deb13u5.aikido.21 < 8.14.1-2+deb13u5.aikido.22 Fix: upgrade to 8.14.1-2+deb13u5.aikido.18
|
| – | haxx | curl |
>= 8.8.0, < 8.21.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Root:Alpine:3.22 | – | curl |
< 8.14.1-r30075 < 8.14.1-r30076 < 8.14.1-r30077 < 8.14.1-r30079 Fix: upgrade to 8.14.1-r30075
|
| Root:Alpine:3.22 | – | rootio-curl |
< 8.14.1-r30075 < 8.14.1-r30076 < 8.14.1-r30077 < 8.14.1-r30079 Fix: upgrade to 8.14.1-r30075
|
| Root:Alpine:3.21 | – | curl |
< 8.14.1-r20074 < 8.14.1-r20075 < 8.14.1-r20076 < 8.14.1-r20077 Fix: upgrade to 8.14.1-r20074
|
| Root:Alpine:3.21 | – | rootio-curl |
< 8.14.1-r20074 < 8.14.1-r20075 < 8.14.1-r20076 < 8.14.1-r20077 Fix: upgrade to 8.14.1-r20074
|
| Alpine:v3.23 | – | curl |
>= 8.8.0, < 8.22.0-r0 Fix: upgrade to 8.22.0-r0
|
| Alpine:v3.24 | – | curl |
>= 8.8.0, < 8.21.0-r0 Fix: upgrade to 8.21.0-r0
|
| Root:Alpine:3.23 | – | curl |
< 8.19.0-r00076 Fix: upgrade to 8.19.0-r00076
|
| Root:Alpine:3.23 | – | rootio-curl |
< 8.19.0-r00076 Fix: upgrade to 8.19.0-r00076
|
Original advisory text
CVE-2026-9079 in curl - Patched by Root
Root has patched CVE-2026-9079 in the curl package for Root:Alpine:3.23. Multiple fixed versions available.
References
- https://ubuntu.com/security/CVE-2026-9079 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8487-1 Vendor Advisory
- https://curl.se/L7HzKXisfJ/CVE-2026-9079.md Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-9079 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-9079 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-9079 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9079.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9079 Vendor Advisory
- https://curl.se/docs/CVE-2026-9079.html Patch Vendor Advisory
- https://curl.se/docs/CVE-2026-9079.json Vendor Advisory
- https://github.com/curl/curl.git Product
- https://hackerone.com/reports/3750295 Exploit Issue Tracking Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-9079 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published11 Aug 2026
Updated11 Oct 2026
First seen24 Jun 2026
Sources
UBUNTU-CVE-2026-9079 · OSV
CURL-CVE-2026-9079 · OSV
CVE-2026-9079 · NVD
CVE-2026-9079 · MITRE
BELL-CVE-2026-9079 · OSV
DEBIAN-CVE-2026-9079 · OSV
CVE-2026-9079 · OSV
ALPINE-CVE-2026-9079 · OSV
Track software like this
Free during beta