Ubuntu published USN-8927-2 with curl fixes for Ubuntu 26.10. It covers issues involving WebSocket handling, connection reuse, and authentication state, and extends previously announced fixes to this release. Ubuntu official announcement
Updating the curl command does not necessarily update every application using libcurl. Bundled libraries and container images can have separate release paths. Distinguish system packages from components delivered with applications.
On this page
The curl executable and libcurl have different consumers
The curl command is a terminal application; libcurl is a library other applications can call for network transfers. A service can therefore need review even when administrators rarely run curl manually. Not every application uses the system library, so connect the installed-package inventory with the dependencies of the actual program rather than assuming one executable represents every consumer.
Distinguish dynamically linked applications from programs bundling their own library. Replacing a system package may help the former while the latter can require an application rebuild or a new image. Long-running processes may also retain an older loaded library. Determine which services must restart after the package update instead of treating the package-manager result as the complete deployment result.
Review the protocols and authentication features actually used
The notice covers several features with different exposure conditions. A simple HTTPS download and an application using proxy authentication or WebSocket handling do not exercise identical paths. Compare the advisory conditions with your actual options when prioritizing review. Not using a particular option can exclude one condition without establishing that the entire update is unnecessary.
After updating, test representative authentication and connection-reuse flows. A successful request to one public website says little about a private proxy, certificate setup, or upload path. Use appropriately restricted test credentials for regression checks, and limit diagnostic output so that verbose transfer logs do not introduce an additional exposure of secrets.
Use the distribution package build as the comparison point
Distributions can backport security fixes without adopting every feature of a newer upstream release. Comparing only the base version printed by curl with the latest internet release can be misleading. USN-8927-2 lists 8.20.0-2ubuntu11.1 for the corrected Ubuntu 26.10 curl, libcurl4t64, and libcurl3t64-gnutls packages. Also check whether the distribution now offers a newer security build.
Record the operating-system release, installed package builds, repository candidates, and deployment status of consuming applications or images separately. A container can use a different distribution from its host, so inspect its own packages too. The following commands are read-only inspection examples; they do not install an update or change service configuration.
cat /etc/os-release
dpkg-query -W curl libcurl4t64 libcurl3t64-gnutls
apt-cache policy curl libcurl4t64 libcurl3t64-gnutlsdpkg-query can report packages that are not installed. The apt-cache candidate reflects the local package lists. Before installing an update, refresh those lists through the organization’s normal update process and compare against the advisory for the actual release. No execution output from a particular server is claimed here.
Define the update scope
- Identify the Ubuntu release and installed package build.
- Separate the curl command, libcurl-dependent apps, and container images.
- Test existing HTTPS, proxy, and authentication workflows after applying the supported fixes.
USN-8927-2 applies to Ubuntu 26.10. Use the matching advisory for other releases rather than forcing the same package string onto them.
Announcement reference date: 2026-10-19 · Checked: October 24, 2026
.jpg){kind=link}