CVE-2026-92387

Publication date 14 October 2026

Last updated 14 October 2026

Description

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

Why is this CVE low priority?

Upstream defined this as low severity

Learn more about Ubuntu priority

Status

Show unmaintained releases

Package	Ubuntu Release	Status
curl	26.04 LTS resolute	Fixed 8.18.0-1ubuntu2.8
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

How can I get the fixes?
What do statuses mean?
Patch details

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
curl	Upstream: 753735a

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-8927-1
curl vulnerabilities
14 October 2026

Other references

https://www.cve.org/CVERecord?id=CVE-2026-92387
https://curl.se/docs/CVE-2026-92387.html