Ubuntu 25.10 curl Important Credential Leak DoS Vuln 8084-1

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Zhicheng Chen discovered that curl could incorrectly reuse the wrong

connection for Negotiate-authenticated HTTP or HTTPS requests. This could

result in the use of credentials from a different connection, contrary to

expectations. (CVE-2026-1965)

It was discovered that curl incorrectly leaked OAuth2 bearer tokens when

following a redirect. This could result in tokens being sent to the wrong

host, contrary to expectations. (CVE-2026-3783)

Muhamad Arga Reksapati discovered that curl incorrectly reused existing

HTTP proxy connections even if the request used different credentials. This

could result in the use of incorrect credentials, contrary to expectations.

(CVE-2026-3784)

Daniel Wade discovered that curl incorrectly handled certain memory

operations when doing a second SMB request to the same host. An attacker

could use this issue to cause curl ...