Affected: curl

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

Affected: Ubuntu:26.04:LTS: curl

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928)

Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929)

Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409)

Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410)

Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412)

Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414)

Stanislav Fort discovered that curl did not correctly handle HSTS entries…