curl 8.21.0

On June 24, after nearly two months of development, 531 commits, and the fixing of 276 bugs, the release of 8.21.0 (№275) of the cross-platform multifunctional console utility and library took place. curl, written in C and distributed under a license. curl.

Key changes

Security

• Medium severity
  • CVE-2026-8925: double free of SASL memory;
  • CVE-2026-8927: authentication state leakage in Digest between proxy servers in env-set;
  • CVE-2026-9079: leakage of stale passwords to proxy servers;
  • CVE-2026-11856: authentication state leakage in Digest between domains.
• Low severity
  • CVE-2026-8286: improper reuse of STARTTLS connection;
  • CVE-2026-8458: improper reuse across different services;
  • CVE-2026-8924: vulnerability in the cookie parsing algorithm with a dot at the end of the domain, allowing a malicious HTTP server to set "super-cookies" that bypassed the Public Suffix List check;
  • CVE-2026-8926: password leakage when using netrc and specifying the username in the URL;
  • CVE-2026-8932: incomplete mTLS configuration matching when reusing connections;
  • CVE-2026-9080: use after free after a socket callback pause;
  • CVE-2026-9545: early HTTP/3 data disclosure (with CURLSSLOPT_EARLYDATA option);
  • CVE-2026-9546: sending an old referrer;
  • CVE-2026-9547: improper host verification when using SSH;
  • CVE-2026-10536: use after free in HTTP/2 thread dependency tree;
  • CVE-2026-11352: hang in QUIC with zero-length UDP datagrams;
  • CVE-2026-11564: retention of trust to the native certificate store even after switching to custom certificates;
  • CVE-2026-11586: WS Auto-PONG memory exhaustion;
  • CVE-2026-12064: proto-default skipped SSH verification.

Other changes

• improvements in named search templates.Examples:

curl "https://img.example/photo[1-1000].jpg" -o "local-#.jpeg"
curl "https://example.{org,com}/{