The curl project released version 8.21.0 on June 24, 2026, addressing 18 security vulnerabilities, a new single-release record for the project.
The update marks the 275th release of the widely used data transfer tool and brings the total number of publicly disclosed curl vulnerabilities to 206.
Among the patched flaws are credential leakage, memory corruption in WebSocket handling, and use-after-free (UAF) vulnerabilities affecting HTTP/2 and socket callbacks.
Project maintainer Daniel Stenberg acknowledged the unusually high volume, noting that the security report intake has been “intense” in recent months.
curl Patches 18 Vulnerabilities
The 18 fixes also set a new record for the most vulnerabilities patched within a single calendar year for the curl project. The release includes 276 bugfixes, 531 commits, and contributions from 102 developers, 69 of whom are new to the project.
Four vulnerabilities were rated Medium severity. CVE-2026-8925 is a SASL double-free bug that could lead to memory corruption during authentication.
CVE-2026-8927 involves an environment-set cross-proxy Digest auth state leak that may expose credentials across proxy boundaries. CVE-2026-9079 addresses a stale proxy password leak where outdated credentials could be unintentionally reused.
CVE-2026-11856 is a cross-origin Digest authentication state leak, which could allow one origin to access authentication state belonging to another.
The remaining 14 flaws were rated Low severity but still carry meaningful real-world risk. CVE-2026-8926 causes a password leak when combining .netrc with a user value embedded in the URL.
CVE-2026-11586 is a WebSocket Auto-PONG memory exhaustion flaw that could enable denial-of-service attacks. CVE-2026-9080 and CVE-2026-10536 are use-after-free bugs triggered in socket callbacks and HTTP/2 stream-dependency trees, respectively.
CVE-2026-9547 and CVE-2026-12064 both affect SSH host verification, with one bypassing validation entirely via protocol-default settings.
Additional low-severity issues include CVE-2026-9545, which unintentionally exposes early HTTP/3 data, and CVE-2026-11352, a QUIC zero-length UDP datagram busy loop that poses a CPU exhaustion risk.
CVE-2026-8932 involves incomplete mTLS configuration matching during connection reuse, while CVE-2026-8286 and CVE-2026-8458 address wrong connection reuse across STARTTLS and different services.
CVE-2026-8924 patches a trailing-dot domain supercookie flaw, CVE-2026-9546 fixes a stale Referer header sent to new destinations, and CVE-2026-11564 addresses persistent native CA trust beyond its intended scope.
Despite the security-heavy development cycle, the release still ships new features. Named glob support was added for URL patterns and output filenames; HTTP/3 proxy CONNECT and MASQUE CONNECT-UDP support are now available; and SHA-256 host public key support has been added via libssh.
The release removes HTTP/2 stream dependency tracking and drops support for CURLAUTH_DIGEST_IE. Future removals include NTLM, SMB, TLS-SRP support, and local crypto implementations.
Users depending on these should raise concerns on the curl-library mailing list as soon as possible. The curl team has scheduled the next release for September 2, 2026, with the cycle extended by two weeks.
Organizations using curl or libcurl in production environments should prioritize upgrading to version 8.21.0 immediately, particularly given the credential leakage and memory corruption risks identified in this release.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
