CVE-2026-92387 is listed by USN-8927-1: curl vulnerabilities.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · Ubuntu Security Notices

   Detected

   It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPT_INTERFACE was used. An attacker could possibly use this issue to cause co

Sources

• CVE.orgVulnerability recordCVE-2026-92387

  Official CVE identifier

  cve.org
• Ubuntu Security NoticesVendor advisoryCVE-2026-92387

  It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly include the interface bind

  ubuntu.com