jammy is affected as well, since 7.81.0-1ubuntu1.30 carries the same CVE-2026-94266 backport. I reproduced it on noble against a local git http-backend behind Basic auth: with http://token@host/repo.git the POST to git-upload-pack goes out without an Authorization header, while token:x@ and x-access-token:token@ URLs keep working. Upstream curl 8.23.0 shows the same behaviour on Debian sid, and git built at 76524c2604 works with all three URL forms against it, so backporting that git commit should fix this without reopening the CVE. This currently breaks Renovate (renovatebot/renovate#47071) and every image based on containerbase from 14.40.0 on.
** CVE added: https://cve.org/CVERecord?id=CVE-2026-94266 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171054 Title: git clone over HTTP with credentials in the URL fails after curl SRU for CVE-2026-94266 (USN-8932-1): "could not read Username" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/curl/+bug/2171054/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
