{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "curl",
                "libcurl4"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.25",
                    "version": "7.81.0-1ubuntu1.25"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.26",
                    "version": "7.81.0-1ubuntu1.26"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11856",
                        "url": "https://ubuntu.com/security/CVE-2026-11856",
                        "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11856",
                                "url": "https://ubuntu.com/security/CVE-2026-11856",
                                "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass by Capture-replay",
                            "    - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential",
                            "      change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and",
                            "      lib/vauth/digest_sspi.c.",
                            "    - CVE-2026-11856",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.26",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 16:14:14 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl4",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.25",
                    "version": "7.81.0-1ubuntu1.25"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.26",
                    "version": "7.81.0-1ubuntu1.26"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-11856",
                        "url": "https://ubuntu.com/security/CVE-2026-11856",
                        "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-11856",
                                "url": "https://ubuntu.com/security/CVE-2026-11856",
                                "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the  `Authorization:` header field meant for `hostA`, to `hostB`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass by Capture-replay",
                            "    - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential",
                            "      change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and",
                            "      lib/vauth/digest_sspi.c.",
                            "    - CVE-2026-11856",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.26",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 16:14:14 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260818 to 20260819",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20260818",
    "to_serial": "20260819",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}