On February 5, after nearly two months of development, version 8.12.0 of the console utility and library was released. curl, written in C and distributed under a license. curl.
Key Changes:
- Vulnerability fixed CVE-2025-0167 – when using a .netrc file, it was possible to pass the password used for the first host to the next host.
- Vulnerability fixed CVE-2025-0665 – in the libcurl library, when closing the connection channel after completing a multithreaded name resolution, the same eventfd file descriptor was mistakenly closed twice.
- Vulnerability fixed CVE-2025-0725 – integer overflow when using zlib version 1.2.0.3 or older.
- Support for reading byte ranges has been added to the --variable command.
- Experimental support for the HTTP backend removed hyper, written in Rust (author's blog note).
- Other improvements and bug fixes.
Source: linux.org.ru
