| Newsgroups |
gmane.linux.lfs.beyond.book |
| Message-ID |
<[email protected]> |
#23216: curl-8.20.0
-----------------------------+-----------------------
Reporter: Douglas R. Reno | Owner: blfs-book
Type: enhancement | Status: new
Priority: elevated | Milestone: 13.1
Component: BOOK | Version: git
Severity: normal | Keywords:
-----------------------------+-----------------------
New minor version
**Release notes:**
{{{
Hello friends.
I have the pleasure of announcing yet another curl release. Thanks
everyone who helped out! Get it as always from https://curl.se/
curl and libcurl 8.20.0
Public curl releases: 274
Command line options: 273
curl_easy_setopt() options: 308
Public functions in libcurl: 100
Authors: 1463
Contributors: 3664
This release includes the following changes:
o async-thrdd: use thread queue for resolving [144]
o build: make NTLM disabled by default [90]
o cmake: drop support for CMake 3.17 and older [108]
o lib: add thread pool and queue [74]
o lib: drop support for < c-ares 1.16.0 [64]
o lib: make SMB support opt-in [18]
o multi.h: add CURLMNWC_CLEAR_ALL [127]
o rtmp: drop support [91]
This release includes the following bugfixes:
o altsvc: cap the list at 5,000 entries [183]
o altsvc: drop the prio field from the struct [185]
o altsvc: skip expired entries read from file [187]
o asyn-ares: connect async [220]
o asyn-ares: drop orphaned variable references [86]
o asyn-ares: fix HTTPS-lookup when not on port 443 [100]
o asyn-thrdd: drop redundant `result` check [291]
o asyn-thrdd: fix clang-tidy unused value warning [125]
o async-ares: fix query counter handling [195]
o autotools: limit checksrc target to ignore non-repo test sources [12]
o badwords-all: exit with correct code on errors [50]
o badwords: combine the whitelisting into a single regex [1]
o badwords: detect the the and with with [51]
o badwords: only check comments and strings in source code [61]
o badwords: rework exceptions, fix many of them [15]
o boringssl: fix more coexist cases with Schannel/WinCrypt [170]
o build: adjust/add casts to fix `-Wformat-signedness` [218]
o build: assume `snprintf()` in `mprintf`, drop feature check [107]
o build: compiler warning silencing tidy-ups [4]
o build: drop `openssl` module dependency for BoringSSL from `libcurl.pc`
[33]
o build: drop duplicate `pthread.h` includes [158]
o build: drop redundant `USE_QUICHE` guards [159]
o build: enable `-Wimplicit-int-enum-cast` compiler warning, fix issues
[84]
o build: fix `-Wformat-signedness` by adjusting printf masks [226]
o build: link `bcrypt.lib` via vcxproj files [239]
o build: skip detecting `pipe2()` for Apple targets [227]
o build: stop building and installing `runtests.1` and `testcurl.1` [235]
o cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR
[132]
o cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR [63]
o cf-ip-happy: limit concurrent attempts [191]
o cf-socket: avoid low risk integer overflow on ancient Solaris [56]
o cfilters: fix Curl_pollset_poll() return code mixup [206]
o clang-tidy: avoid assignments in `if` expressions [175]
o clang-tidy: enable more checks, fix fallouts [254]
o cmake: add CMake Config-based dependency detection [87]
o cmake: add CMake Config-based dependency detection for c-ares, wolfSSL
[134]
o cmake: do not install `wcurl` when `BUILD_CURL_EXE=OFF` [265]
o cmake: do not install shell completions when `BUILD_CURL_EXE=OFF` [263]
o cmake: document functions used from Windows system DLLs [103]
o cmake: enable pthreads for BoringSSL/AWS-LC [196]
o cmake: resolve targets recursively when generating `libcurl.pc` [45]
o cmake: rework binutils ld hack to not read `LOCATION` property [41]
o cmake: silence bad library `Threads::Threads` warning [131]
o cmake: use `AIX` built-in variable (with CMake 4.0+) [163]
o config2setopts: make --capath work in proxy disabled builds [113]
o configure: fix `--with-ngtcp2=<path>` option for crypto libs [26]
o configure: fix LibreSSL ngtcp2 1.15.0+ crypto lib selection logic [3]
o configure: prefer dependency-specific variables over `$withval` [35]
o configure: remove superfluous experimental warning for HTTP/3 [169]
o configure: silence useless clang warnings in C89 builds [156]
o configure: tidy up comments [202]
o connect: fix typo on error message
o cookie: fix rejection when tabs in value [189]
o curl-wolfssl.m4: fix to use the correct value for pkg-config directory
[36]
o curl.h: replace macros with C++-friendly method to enforce 3 args [110]
o curl_ctype.h: fix spelling in a couple of locally used macros [28]
o curl_get_line: error out on read errors [9]
o curl_get_line: fix potential infinite loop when filename is a directory
[46]
o curl_ngtcp2: extend and update callbacks for 1.22.0+ [165]
o curl_ntlm_core: drop redundant PP condition [140]
o curl_ntlm_core: use wolfCrypt DES API with wolfSSL [200]
o curl_setup.h: drop stray/unused `USE_OPENSSL_QUIC` guard [210]
o curl_sha512_256: support delegating to wolfSSL API [149]
o curl_version_info.md: clarify age details [69]
o CURLOPT_HAPROXY_CLIENT_IP.md: mention assumption on data format [96]
o CURLOPT_RTSP_SESSION_ID.md: clarify reuse "dangers" [270]
o CURLOPT_RTSP_SESSION_ID.md: expand the comment [267]
o CURLOPT_RTSP_SESSION_ID.md: minor language fix
o CURLOPT_SOCKS5_AUTH.md: an access property [212]
o CURLOPT_SSL_CTX_FUNCTION.md: expand on effects connection reuse [105]
o CURLOPT_UPLOAD_FLAGS.md: expand [223]
o curlx_now(), prevent zero timestamp [93]
o DEPRECATE: fix minor release number typo
o digest: pass in the user name quoted (as well) [34]
o dns: https-eyeballing async [229]
o dnscache: own source file, improvements [116]
o docs/cmdline-opts/write-out.md: tls_earlydata was adeded in 8.13.0
o docs/cmdline-opts: tidy up retry-connrefused [190]
o docs/lib: fix typos [53]
o docs/libcurl: improve easy setopt examples [266]
o docs: clarify retry-max-time timing [294]
o docs: CURLOPT_LOGIN_OPTIONS is a login property [228]
o docs: enable more compiler warnings for C snippets, fix 3 finds [71]
o docs: list more dependencies for running Python HTTP tests [123]
o docs: mention more zip bomb precautions [166]
o docs: minor wording tweaks
o docs: noproxy wants the punycoded hostname version [214]
o docs: SSH host verification is done at connect time [197]
o docs: use the correct CURLOPT_WRITEFUNCTION signature [142]
o doh: fix memory-leak when doing a second DoH resolve [55]
o doh: remove superfluous doh_req check [222]
o examples/websocket: fix to sleep more on Windows [92]
o examples: drop warning silencers no longer hit [14]
o examples: fix typo in comment [75]
o file: init fd to -1 to prevent close fd 0 on early failure [40]
o fopen: for temp files, inherit permissions only for owner [146]
o ftp: do not strdup DATA hostname [29]
o ftp: make the MDTM date parser stricter (again) [115]
o ftp: reject PWD responses containing control characters [95]
o gcc: guard `#pragma diagnostic` in core code for <4.6 [94]
o generate.bat: remove extra % from VC11 and VC12 runs
o genserv.pl: make external calls safe [119]
o getinfo: initialize `PureInfo` field `used_proxy` [43]
o getinfo: repair CURLINFO_TLS_SESSION [193]
o gnutls: fix clang-tidy warning with !verbose [126]
o gtls: fail for large files in `load_file()` [174]
o h3: HTTPS-RR use in HTTP/3 [221]
o Happy Eyeballs: add resolution time delay [238]
o haproxy: use correct ip version on client supplied address [275]
o hostip: clear the sockaddr_in6 structure before use [20]
o hostip: init the curl_jmpenv_lock appropriately [278]
o hostip: resolve user supplied ip addresses [259]
o HSTS: cap the list [177]
o hsts: make the HSTS read callback handle name dupes [141]
o hsts: skip expired HSTS entries read from file [188]
o hsts: when a dupe host adds subdomains, use that [130]
o http2: clear the h2 session at delete [99]
o http2: prevent secure schemes pushed over insecure connections [181]
o http2: return error on OOM in push headers [65]
o HTTP3.md: drop outdated mentions of OpenSSL-QUIC [2]
o http: clear credentials better on redirect [204]
o http: clear digest nonce on cross-orgin redirect [269]
o http: clear the proxy credentials as well on port or scheme change
[246]
o http: fix auth_used and auth_avail [154]
o http: fix Curl_compareheader for multi value headers [11]
o http: make Curl_compareheader handle multiple commas in header
o http: on 303, switch to GET [208]
o http: use header_has_value() instead of duplicate code [251]
o imap: reset the UIDVALIDITY state between transfers [7]
o include: drop 'will' from public headers [73]
o INSTALL.md: update Cygwin instructions [198]
o keylog.h: replace literal number with macro in declaration [171]
o keylog: drop unused/redundant includes and guards [172]
o ldap: drop duplicate `ldap_set_option()` on Windows [42]
o ldap: fix to initialize cleartext connection on Windows [49]
o lib1560: fix comment typo
o lib1960: fix test failure [255]
o lib: accept larger input to md5/hmac/sha256/sha512 functions [194]
o lib: always use Curl_1st_fatal instead of Curl_1st_err [89]
o lib: fix typos in comments [240]
o lib: make resolving HTTPS DNS records reliable: [176]
o lib: minor comment typos [237]
o lib: move request specific allocations to the request struct [256]
o lib: replace `PRI*32` printf masks with C89 ones [201]
o libssh2: allocate libssh2-friendly memory in kbd_callback [225]
o libssh2: fix error handling on quote errors [21]
o libssh: fix 64-bit printf mask for mingw-w64 <=6.0.0 [215]
o libssh: fix `-Wsign-compare` in 32-bit builds [217]
o libssh: path length precaution [164]
o libssh: propagate error back in SFTP function [178]
o libtest: drop duplicate include [111]
o location/follow: mention netrc [138]
o man: fix argument type for `CURLSHOPT_[UN]SHARE` options [211]
o mbedtls: cleanup more without care for 'initialized' [262]
o mbedtls: fix ECJPAKE matching [135]
o mbedtls: remove failf() call with first argument as NULL [249]
o md4, md5: switch to wolfCrypt API in wolfSSL builds [139]
o mime: only allow 40 levels of calls [241]
o misc: fix code quality findings [209]
o mk-ca-bundle.pl: make `ca-bundle.crt` timestamp match `certdata.txt`'s
[44]
o multi: enhance pending handles fairness [284]
o multi: fix connection retry for non-http [180]
o multi: improve wakeup and wait code [118]
o netrc: find login-less password when user is given in URL [6]
o netrc: remove unused parsenetrc() macro for netrc-disabled [121]
o netrc: skip malformed macdef lines [67]
o openssl channel_binding: lookup digest algorithm without NID [117]
o openssl: drop obsolete SSLv2 logic [27]
o openssl: fix build with 4.0.0-beta1 no-deprecated [184]
o openssl: fix memory leaks in ECH code (OpenSSL 3) [78]
o openssl: fix unused variable warnings in !verbose builds [252]
o openssl: trace count of found / imported Windows native CA roots [8]
o OS400: add new definitions to the ILE/RPG binding. [153]
o os400sys: fix typo in comment (symetry -> symmetry) [58]
o parsedate: bsearch the time zones [232]
o parsedate: fix wrong treatment of "military time zones" [182]
o parsedate: refactor [230]
o perl: harden external command invocations [133]
o progress: count amount of data "delivered" to application [66]
o protocol.h: fix the CURLPROTO_MASK [31]
o protocol: disable connection reuse for SMB(S) [199]
o protocol: use scheme names lowercase [38]
o proxy: chunked response, error code [143]
o pytest: add additional quiche check for flaky test_05_01 [22]
o pytest: check 429 handling [268]
o rand: use `BCryptGenRandom()` in UWP builds [88]
o ratelimit: reset on start [150]
o request: reset resp_trailer in new requests [186]
o runtests: skip setting ed25519 SSH key format [264]
o rustls: fix memory leak on repeated SSLKEYLOGFILE fails [280]
o rustls: handle EOF during initial handshake [203]
o schannel: increase renegotiation timeout to 60 seconds [261]
o scripts: drop redundant double-quotes: `"$var"` -> `$var` (Perl) [109]
o scripts: harden / tidy up more Perl `system()` calls [70]
o sectrust: fail on missing OCSP stapling [250]
o sendf: fix CR detection if no LF is in the chunk [219]
o setopt: clear proxy auth properties when switching [192]
o setopt: fix typos in comments [257]
o setopt: move CURLOPT_CURLU [260]
o setup connection filter: mark as setup [234]
o sha256, sha512_256: switch to wolfCrypt API [147]
o sha256: support delegating to wolfSSL API [148]
o share: concurrency handling, easy updates [104]
o share: do bitshifts after the type is checked to be valid [216]
o socks: reject zero-length GSSAPI/SSPI tokens from proxy [157]
o socks: use dns filter for resolving [244]
o spelling: fix typos [173]
o src: use ftruncate() unconditionally [128]
o sshserver.pl: harden more `system()` calls [81]
o sshserver.pl: pass command-line to `system()` safely [82]
o strerr: correct the strerror_s() return code condition [25]
o sws: fix potential OOB write [80]
o synctime: fix off-by-one read and write to a read-only buffer (Windows)
[85]
o test 766: flag as timing-dependent [136]
o test1675: unit tests for URL API helper functions [248]
o test459: switch to mode="warn" for stderr check [5]
o testcurl.pl: replace shell commands with Perl `rmtree()` [76]
o tests/unit/README: describe how to unit test static functions [60]
o tests: avoid infinite recursion for `make check` [253]
o tests: use %b64[] instead of "raw" base64 [245]
o tool: check for curlinfo->age when determining if ssh backend [77]
o tool: fix memory mixups [106]
o tool: fix retries in parallel mode [137]
o tool: fix two more allocator mismatches [155]
o tool_cb_hdr: only truncate etags output when regular file [129]
o tool_cb_rea: make waitfd() return void [168]
o tool_cb_wrt: fix no-clobber error handling [39]
o tool_cfgable: free the SSL signature algorithms [62]
o tool_dirhie: fix to create drive-relative directory [276]
o tool_formparse: propagate my_get_line errors when reading headers [102]
o tool_getparam: use correct free function for libcurl memory [68]
o tool_ipfs: accept IPFS gateway URL without set port number [13]
o tool_msgs: avoid null pointer deref for early errors [98]
o tool_operate: actually apply the --parallel-max-host limit [167]
o tool_operate: drop the scheme-guessing in the -G handling [54]
o tool_operate: fix condition for loading `curl-ca-bundle.crt` (Windows)
[79]
o tool_operate: fix memory-leak on failed uploads [124]
o tool_operate: fix minor memory-leak on early error [23]
o tool_operate: reset the upload glob counter for next URL [162]
o tool_operhlp: fix `add_file_name_to_url()` result on OOM [32]
o tool_operhlp: iterate through all slashes to find name [114]
o tool_operhlp: propagate low-level OOM in `add_file_name_to_url()` [112]
o tool_setopt: return error on OOM correctly [152]
o tool_urlglob: fix memory-leak on glob range overflow [19]
o top-complexity: prevent filename-based shell injection risk [101]
o transfer: clear the old autoreferer [236]
o transfer: clear the URL pointer in OOM to avoid UAF [179]
o transfer: enable custom methods again on next transfer [30]
o transfer: enhance secure check [10]
o unit1675: fix `-Wformat-signedness` [274]
o url: do not reuse a non-tls starttls connection if new requires TLS
[145]
o url: improve connection reuse on negotiate [160]
o url: init req.no_body in DO so that it works for h2 push [161]
o url: set default upload flags to CURLULFLAG_SEEN [224]
o url: use the socks type for socks proxy [47]
o url: use URL for url even in comments [52]
o urlapi: fix handling of "file:///" [122]
o urlapi: make dedotdotify handle leading dots correctly [97]
o urlapi: same origin tests [213]
o urlapi: stop extracting hostname from file:// URLs on Windows [247]
o urlapi: verify the last letter of a scheme when set explicitly [16]
o urldata.h: fix typo and lingering backtick [279]
o urldata: connection bit ipv6_ip is wrong [59]
o urldata: import port types and conn destination format [57]
o urldata: make hstslist only present in HSTS builds [120]
o urldata: make speeder_c uint32 [37]
o urldata: move cookiehost to struct SingleRequest [242]
o urldata: remove trailers_state [17]
o vquic: fix variable name in fallback code [207]
o vtls: fix comment typos and tidy up a type [285]
o vtls: log when key logging is enabled. [288]
o vtls_scache: check reentrancy [243]
o vtls_scache: include cert_blob independently of verifypeer [231]
o wolfssl: document v5.0.0 (2021-11-01) as minimum required [151]
o wolfssl: fix `-Wmissing-prototypes` [233]
o wolfssl: fix handling of abrupt connection close [24]
o write-out.md: minor language fix [273]
o write-out.md: tls_earlydata was adeded in 8.13.0
o ws: fix a blocking curl_ws_send() to report written length correctly
[258]
o x509asn1: fix to return error in an error case from `encodeOID()` [83]
o x509asn1: fixed and adapted for ASN1tostr unit testing [48]
o x509asn1: improve encodeOID [72]
This release includes the following known bugs:
See https://curl.se/docs/knownbugs.html
For all changes ever done in curl:
See https://curl.se/changes.html
Planned upcoming removals include:
o local crypto implementations
o NTLM
o SMB
o TLS-SRP support
See https://curl.se/dev/deprecate.html
}}}
As always with a new cURL, there are several security fixes.
**CVE-2026-4873**
{{{
connection reuse ignores TLS requirement
========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-4873.html)
VULNERABILITY
-------------
A vulnerability exists where a connection requiring TLS incorrectly reuses
an
existing unencrypted connection from the same connection pool. If an
initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent
request
to that same host will bypass the TLS requirement and instead transmit
data
unencrypted.
INFO
----
This flaw requires a rather special series of events to trigger. Such a
series
is unlikely to be used much in the wild.
This issue only happens for transfers done using `IMAP://`, `POP3://` or
`SMTP://` URL schemes. The initial transfer and the second transfer both
need
to be done to the same host, use the same credentials and the same URL
schemes. The login and the initial transfer is done over clear-text, so
the
user is obviously already accepting an insecure transmission for this.
This
flaw still makes it worse as the second transfer is intended to be secured
by
TLS but is not.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-4873 to this issue.
CWE-319: Cleartext Transmission of Sensitive Information
Severity: Low
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.20.0 to and including 8.19.0
- Not affected versions: curl < 7.20.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/ec3bb8f727405642a
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw also affects the curl command line tool.
SOLUTION
--------
curl 8.20.0 fixes this logical flaw
- Fixed-in: https://github.com/curl/curl/commit/507e7be573b0a76fca597b75
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Do not use clear-text IMAP/POP3/SMTP transfers
}}}
**CVE-2026-5545**
{{{
wrong reuse of HTTP Negotiate connection
========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-5545.html)
VULNERABILITY
-------------
libcurl might in some circumstances reuse the wrong connection when asked
to
do an authenticated HTTP(S) request after a Negotiate-authenticated one,
when
both use the same host.
libcurl features a pool of recent connections so that subsequent requests
can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a
logical
error in the code, a request that was issued by an application could
wrongfully reuse an existing connection to the same server that was
authenticated using different credentials.
An application that first uses Negotiate authentication to a server with
`user1:password1` and then does another operation to the same server
asking
for any authentication method but for `user2:password2` (while the
previous
connection is still alive) - the second request gets confused and wrongly
reuses the same connection and sends the new request over that connection
thinking it uses a mix of user1's and user2's credentials when it is in
fact
still using the connection authenticated for user1...
INFO
----
The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.
Applications can disable libcurl's reuse of connections and thus mitigate
this
problem, by using one of the following libcurl options to alter how
connections are or are not reused: `CURLOPT_FRESH_CONNECT`,
`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the
curl_multi API).
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-5545 to this issue.
This flaw is similar to [CVE-2026-1965](CVE-2026-1965.md).
CWE-305: Authentication Bypass by Primary Weakness
Severity: Medium
AFFECTED VERSIONS
-----------------
This flaw has existed since curl started to support Negotiate.
- Affected versions: from curl 7.10.6 to and including 8.19.0
- Not affected versions: curl < 7.10.6 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/e56ae1426c
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw **also** affects the curl command line tool.
SOLUTION
--------
curl 8.20.0 makes sure that connections using Negotiate are not wrongly
reused.
- Fixed-in: https://github.com/curl/curl/commit/33e43985b8f3b9e6669
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using HTTP Negotiate in your application
}}}
**CVE-2026-5773**
{{{
wrong reuse of SMB connection
=============================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-5773.html)
VULNERABILITY
-------------
libcurl might in some circumstances reuse the wrong connection for SMB(S)
transfers.
libcurl features a pool of recent connections so that subsequent requests
can
reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a
logical
error in the code, a network transfer operation that was requested by an
application could wrongfully reuse an existing SMB connection to the same
server that was using a different "share" than the new subsequent transfer
should.
This could in unlucky situations lead to the download of the wrong file or
the
upload of a file to the wrong place. When this happens, the same
credentials
are used and the server name is the same.
INFO
----
curl only supports SMB version 1 and no later version. SMB version 1 is
considered insecure and deprecated and is therefore commonly disabled in
servers. curl is scheduled to drop support for SMB later in 2026. SMB
support
is opt-in since 8.20.0.
In this flaw, the code simply erroneously did not consider the share name
as a
property to match for connection reuse.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-5773 to this issue.
CWE-488: Exposure of Data Element to Wrong Session
Severity: Low
AFFECTED VERSIONS
-----------------
This flaw has existed since curl started to support SMB.
- Affected versions: from curl 7.40.0 to and including 8.19.0
- Not affected versions: curl < 7.40.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/aec2e865f0
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw **also** affects the curl command line tool.
SOLUTION
--------
curl 8.20.0 makes sure that connections using SMB never get reused.
- Fixed-in: https://github.com/curl/curl/commit/74a169575d6412d
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using SMB
}}}
**CVE-2026-6523**
{{{
proxy credentials leak over redirect-to proxy
=============================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6253.html)
VULNERABILITY
-------------
curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL
schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say `http://`), curl is asked to
follow
a redirect to a URL using another scheme (say `https://`), accessed
using a
second, different, proxy
INFO
----
The credentials are passed on base64 encoded. The receiving proxy gets no
hint
as for where or how the credentials are valid.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-6253 to this issue.
CWE-522: Insufficiently Protected Credentials
Severity: Medium
AFFECTED VERSIONS
-----------------
This flaw has existed since curl added support for credentials in proxy
strings.
- Affected versions: from curl 7.14.1 to and including 8.19.0
- Not affected versions: curl < 7.14.1 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/3b60bb725913ce
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw **also** affects the curl command line tool.
SOLUTION
--------
- Fixed-in: https://github.com/curl/curl/commit/188c2f166a20fa97c2325
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using proxies with credentials
}}}
**CVE-2026-6276**
{{{
stale custom cookie host causes cookie leak
===========================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6276.html)
VULNERABILITY
-------------
Using libcurl, when a custom `Host:` header is first set for a HTTP
request
and a second request is subsequently done using the same *easy handle* but
without the custom `Host:` header set, the second request would use stale
information and pass on cookies meant for the first host in the second
request. Leak them.
INFO
----
Setting a custom `Host:` header is mostly done for debugging purposes when
doing clear text HTTP transfers. When using HTTPS, setting a custom
hostname
like this is not enough for asking for a specific virtual host since then
the
SNI also needs to be correct. This condition reduces the impact of this
flaw,
and is probably a contributing factor why no one else found it before
this.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-6276 to this issue.
CWE-346: Origin Validation Error
Severity: Low
AFFECTED VERSIONS
-----------------
- Affected versions: from curl 7.71.0 to and including 8.19.0
- Not affected versions: curl < 7.71.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/e15e51384a423be3131
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw does **not** affect the curl command line tool.
SOLUTION
--------
- Fixed-in: https://github.com/curl/curl/commit/3a19987a87f393d9394fe5ac
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using custom `Host:` headers
}}}
**CVE-2026-6429**
{{{
netrc credential leak with reused proxy connection
==================================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-6429.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
INFO
----
To trigger, this flaw requires that both the original URL and the redirect
URL
are using clear text `http://` URLs, that both are performed over the same
HTTP proxy and that the same connection is reused.
Similar to [CVE-2024-11053](https://curl.se/docs/CVE-2024-11053.html)
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-6429 to this issue.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Severity: Medium
AFFECTED VERSIONS
-----------------
- Affected versions: from curl 7.14.0 to and including 8.19.0
- Not affected versions: curl < 7.14.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/01165e08e0d131b399fb
libcurl is used by many applications, but not always advertised as such!
This bug is not considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw does **not** affect the curl command line tool.
SOLUTION
--------
- Fixed-in: https://github.com/curl/curl/commit/b4024bf808bd558026fdc6
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to curl and libcurl 8.20.0
B - Apply the patch and rebuild libcurl
C - Avoid using the combination netrc, HTTP and HTTP proxy
}}}
NOTE: If anyone reviews the security information, we are *not* affected by
CVE-2026-7009 as that vulnerability is specific to Apple devices.
**CVE-2026-7168**
{{{
cross-proxy Digest auth state leak
==================================
Project curl Security Advisory, April 29 2026
[Permalink](https://curl.se/docs/CVE-2026-7168.html)
VULNERABILITY
-------------
Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host
to
a second one (`proxyB`) for a second transfer, reusing the same handle,
makes
libcurl wrongly pass on the `Proxy-Authorization:` header field meant for
`proxyA`, to `proxyB`.
INFO
----
An evil `proxyB` could use this incoming request header field to
impersonate
the client in communicating with `proxyA`, as the header contains the
authenticated state.
There is nothing in the request details passed to `proxyB` that reveal the
name or the address of `proxyA`, which mitigates this problem.
This bug is **not** considered a *C mistake* (likely to have been avoided
had
we not been using C).
This flaw does not affect the curl command line tool.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2026-7168 to this issue.
CWE-294: Authentication Bypass by Capture-replay
Severity: Medium
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.12.0 to and including 8.19.0
- Not affected versions: curl < 7.12.0 and >= 8.20.0
- Introduced-in: https://github.com/curl/curl/commit/fc6eff13b5414caf6edf
libcurl is used by many applications, but not always advertised as such!
SOLUTION
------------
- Fixed-in: https://github.com/curl/curl/commit/c1cfdf59acbaf9504c45
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade curl and libcurl to version 8.20.0
B - Apply the patch to your version and rebuild
C - Avoid reusing handles when changing proxies
}}}
Rating as Elevated as none of these issues are rated High or greater
--
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23216>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch
--
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page