Ubuntu curl Security Advisory USN-8525-1: Fixes for CVE-2024-11053 (UAF/RCE) and CVE-2024-8096

Vulnerability Overview Vulnerability ID: USN-8525-1 Publication Date: July 9, 2026 Description: Multiple security vulnerabilities exist in curl, including: - CVE-2024-11053: curl incorrectly handles credentials during HTTP redirection, potentially leading to information leakage. - CVE-2024-8096: A vulnerability in curl's handling of OCSP stapling responses may lead to information leakage. - CVE-2024-11053: A use-after-free vulnerability exists in curl when resetting and cleaning up HTTP/2 stream handles, which could result in denial of service or arbitrary code execution. Affected Versions Affected Ubuntu Versions: - Ubuntu 14.04 LTS - Ubuntu 16.04 LTS - Ubuntu 18.04 LTS - Ubuntu 20.04 LTS - Ubuntu 24.04 LTS - Ubuntu 25.10 Remediation Update the curl package: - Ubuntu 26.04 LTS: - : 8.18.0-1ubuntu2.3 - : 8.18.0-1ubuntu2.3 - : 8.18.0-1ubuntu2.3 - : 8.18.0-1ubuntu2.3 - : 8.18.0-1ubuntu2.3 - Ubuntu 25.10: - : 8.14.1-2ubuntu1.5 - : 8.14.1-2ubuntu1.5 - : 8.14.1-2ubuntu1.5 - : 8.14.1-2ubuntu1.5 - : 8.14.1-2ubuntu1.5 - Ubuntu 24.04 LTS: - : 8.5.0-2ubuntu10.11 - : 8.5.0-2ubuntu10.11 - : 8.5.0-2ubuntu10.11 - : 8.5.0-2ubuntu10.11 - : 8.5.0-2ubuntu10.11 - Ubuntu 20.04 LTS: - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - : 7.68.0-1ubuntu2.25+esm5 - Ubuntu 18.04 LTS: - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - : 7.58.0-2ubuntu3.24+esm10 - Ubuntu 16.04 LTS: - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - : 7.47.0-1ubuntu2.19+esm17 - Ubuntu 14.04 LTS: - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 - : 7.35.0-1ubuntu2.20+esm21 References CVE-2026-7168 CVE-2026-5773 CVE-2026-5545 CVE-2026-12064 CVE-2026-11586 CVE-2026-11564 CVE-2026-11352 CVE-2026-10536 CVE-2024-8096 CVE-2024-11053 Related Notices USN-8227-1 USN-7162-1 USN-7012-1 Reducing Security Risk Ubuntu Pro provides ten years of security coverage for over 25,000 packages in the Main and Universe repositories, free for use on up to five machines. Other Issues For any other questions, please contact the team members.

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu curl Security Advisory USN-8525-1: Fixes for CVE-2024-11053 (UAF/RCE) and CVE-2024-8096