CVE-2026-87864 is listed by USN-8932-1: curl vulnerabilities.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · Ubuntu Security Notices

   Detected

   Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-86409) Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by r

Sources

• CVE.orgVulnerability recordCVE-2026-87864

  Official CVE identifier

  cve.org
• Ubuntu Security NoticesVendor advisoryCVE-2026-87864

  Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-8

  ubuntu.com