On April 29th, after more than a month of development, 521 commits, and fixing 282 bugs, version 8.20.0 (the 274th) of the cross-platform console utility and library was released. curl, written in C and distributed under a license. curl.
Key changes
Security
As mentioned earlier ("High quality chaos"), there has been a significant increase in reported security issues lately. This time, information was published about eight new vulnerabilities in curl:
- CVE-2026-7168: Digest authentication state leak between proxy servers;
- CVE-2026-7009: OCSP stapling bypass via Apple SecTrust;
- CVE-2026-6429: netrc credential leak on proxy connection reuse;
- CVE-2026-6276: outdated host for custom cookies led to leakage;
- CVE-2026-6253: credential leak when redirecting to a proxy server;
- CVE-2026-5773: incorrect SMB connection reuse;
- CVE-2026-5545: incorrect reuse of HTTP Negotiate connection;
- CVE-2026-4873: TLS requirements ignored on connection reuse.
Other changes
- a thread pool and queue are now used for resolving;
- NTLM is disabled by default;
- support for CMake 3.17 and older has been discontinued;
- support for c-ares library versions older than 1.16.0 has been discontinued;
- SMB is disabled by default;
- added the CURLMNWC_CLEAR_ALL flag for all network changes;
- support for RTMP has been discontinued..
Upcoming removal plans
- Local implementations of cryptographic algorithms;
- NTLM;
- SMB;
- support for TLS-SRP.
If you are concerned about any of the mentioned issues, please report them in the curl repository as soon as possible.
Source: linux.org.ru
