THREATIST.IORead the docs curl security, bug fix, and enhancement update
Released 2026-10-29 · Red Hat rating Important · View on Red Hat →
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, mak…
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check.
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests.
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services".