Ubuntu curl Security Updates: Check libcurl as Well as the Command

Ubuntu published curl security updates on October 14 for both the command-line program and libcurl, the library used by other applications. The most serious issue in Canonical's summary, CVE-2026-92392, affects Ubuntu 26.04 LTS. Older supported releases need other fixes from the same disclosure, even though they are not affected by that particular flaw.

Which installed version needs replacing?

The Ubuntu Security Team's advisory gives these fixed source-package versions for releases receiving standard support:

• Ubuntu 26.04 LTS: 8.18.0-1ubuntu2.8.
• Ubuntu 24.04 LTS: 8.5.0-2ubuntu10.16.
• Ubuntu 22.04 LTS: 7.81.0-1ubuntu1.30.

Those numbers are different because each Ubuntu release maintains its own packages. A lower upstream version does not automatically mean the fix is missing: the Ubuntu revision at the end matters. Compare against the entry for your installed release, rather than treating the newest curl version on another distribution as the minimum requirement.

For Ubuntu 20.04 LTS and older releases, Canonical provides the fixes through Expanded Security Maintenance. That requires the appropriate Ubuntu Pro coverage. Simply seeing an older installation complete an ordinary update check does not establish that its security repositories are enabled.

Check the library, then apply the update

Open a terminal and list installed packages built from the curl source package with Canonical's documented check:

apt list '?installed ?source-package(^curl$)'

This catches library packages as well as the curl executable. A machine can have an affected libcurl package without its owner regularly using the curl command.

Canonical recommends updating the complete system. Review the proposed changes before confirming:

sudo apt update
sudo apt upgrade

Where a full update is not possible, its targeted alternative is:

sudo apt update
sudo apt install --only-upgrade '?source-package(^curl$)'

Run the inventory command again afterwards and compare the resulting Ubuntu revisions. Packages bundled inside an application or container need checking through their own supplier or image build; updating the host's packages cannot prove that those separate copies have changed.

The high-severity issue has a narrower scope

Canonical assesses CVE-2026-92392 at 8.1 under CVSS 3.1. It says remote code execution requires a malicious server and complex exploitation conditions. Contacting only trusted servers can reduce exposure while arranging the update, but it does not replace installing the patch.

Other issues involve different protocols and uses of libcurl, so the severity of one CVE should not stand in for the whole package's status. As with our earlier libpcap update report, the useful result is a verified installed package revision. An update notification, or a familiar-looking upstream version, is only the start of that check.