On June 24, after almost two months of development, 531 commits, and 276 bug fixes, the cross-platform, multifunctional console utility and library 8.21.0 (#275) was released. curlwritten in C and distributed under license curl.
Major changes
Security
- Medium level of severity
- CVE-2026-8925: SASL double free;
- CVE-2026-8927: Digest authentication state leak between proxies in env-set;
- CVE-2026-9079: leak of outdated passwords to proxy servers;
- CVE-2026-11856: Cross-domain Digest authentication state leak.
- Low level of severity
- CVE-2026-8286: incorrect reuse of STARTTLS connection;
- CVE-2026-8458: incorrect reuse for different services;
- CVE-2026-8924: A vulnerability in the cookie parsing algorithm with a period at the end of the domain allowed a malicious HTTP server to install "super-cookies" that bypassed the Public Suffix List check;
- CVE-2026-8926: Password leak when using netrc and specifying username in URL;
- CVE-2026-8932: incomplete mTLS configuration match when reusing a connection;
- CVE-2026-9080: memory usage after release after pause in socket callback;
- CVE-2026-9545: HTTP/3 early data disclosure (with CURLSSLOPT_EARLYDATA option);
- CVE-2026-9546: sending old referrer;
- CVE-2026-9547: Incorrect host check when using SSH;
- CVE-2026-10536: memory usage after freeing HTTP/2 stream dependency tree;
- CVE-2026-11352: QUIC wait loop with zero-length UDP datagrams;
- CVE-2026-11564: maintaining trust in the native certificate store even after switching to custom certificates;
- CVE-2026-11586: WS Auto-PONG memory exhaustion;
- CVE-2026-12064: proto-default was skipping SSH check.
Other changes
- improvements in named search patterns. Examples:
curl "https://img.example/photo[ 1-1000].jpg" -o "local-# .jpeg"
curl "https://example.{ org,com}/{ apples, mugs, coins}/img[ 1-1000].jpg" -o "file-# -# -# "
curl -T "{ one,two,three}.jpg" https://ul.example/ -o "save-# "
curl -T "{ one, two, three}.jpg" https://{ ul1,ul2,ul3}.example/ -o "save-# -# "
- Added support for CONNECT and MASQUE CONNECT-UDP HTTP/3 proxy methods;
- HTTP/2 stream dependency tracking removed;
- Removed support for CURLAUTH_DIGEST_IE;
- Added support for SHA256 host public keys using libssh.
Upcoming deletions
- local implementations of cryptographic algorithms;
- Support for NTLM, SMB and TLS-SRP.
Source: linux.org.ru
