The curl project has announced the release of version 8.21.0, marking its 275th release and including a significant security update. This version addresses 18 newly disclosed vulnerabilities, reflecting an unusually high volume of security reports.
Project maintainer Daniel Stenberg announced on June 24, 2026. This release sets a record for the number of vulnerabilities addressed in a single release and for the highest number of vulnerabilities handled in a calendar year.
Curl 8.21.0 Released
The update comes after a 56-day development cycle that included 531 commits and 276 bug fixes, with contributions from over 100 developers. This highlights the extensive security auditing efforts surrounding curl and libcurl.
Most of the vulnerabilities are classified as medium or low severity. However, some could potentially lead to credential leaks, memory corruption, or improper authentication handling depending on the deployment context.
Among the medium-severity vulnerabilities, CVE-2026-8925 is a SASL double-free vulnerability that may result in memory corruption. Similarly, CVE-2026-8927 and CVE-2026-11856 expose vulnerabilities related to cross-proxy and cross-origin Digest authentication state leaks.
CVE-2026-9079 highlights the risks of stale proxy passwords, which could expose sensitive credentials in environments that use multiple proxies.
The remaining low-severity vulnerabilities illustrate a broad attack surface across various protocols and features.
For instance, CVE-2026-9080 involves a use-after-free issue in a socket callback, CVE-2026-10536 pertains to an HTTP/2 stream dependency use-after-free flaw, and CVE-2026-11586 indicates a memory exhaustion issue in WebSocket Auto-PONG under specific conditions.
Other vulnerabilities affect protocol handling and security controls; these include improper SSH host validation (CVE-2026-9547), incorrect reuse of STARTTLS (CVE-2026-8286), and skipped SSH verification due to default protocol settings (CVE-2026-12064).
Additionally, several vulnerabilities pose information disclosure risks, such as leaking referer headers (CVE-2026-9546) or exposing HTTP/3 early data (CVE-2026-9545).
| CVE ID | Severity | Description |
|---|---|---|
| CVE-2026-8925 | Medium | SASL double-free |
| CVE-2026-8927 | Medium | Cross-proxy Digest auth leak |
| CVE-2026-9079 | Medium | Stale proxy password leak |
| CVE-2026-11856 | Medium | Cross-origin auth leak |
| CVE-2026-8286 | Low | STARTTLS reuse issue |
| CVE-2026-8458 | Low | Incorrect service reuse |
| CVE-2026-8924 | Low | Cookie handling issue |
| CVE-2026-8926 | Low | Password leak via netrc |
| CVE-2026-8932 | Low | mTLS reuse mismatch |
| CVE-2026-9080 | Low | Use-after-free |
| CVE-2026-9545 | Low | HTTP/3 early data exposure |
| CVE-2026-9546 | Low | Old referer leak |
| CVE-2026-9547 | Low | SSH validation flaw |
| CVE-2026-10536 | Low | HTTP/2 UAF |
| CVE-2026-11352 | Low | QUIC busy-loop |
| CVE-2026-11564 | Low | CA trust persistence |
| CVE-2026-11586 | Low | Memory exhaustion |
| CVE-2026-12064 | Low | SSH verification bypass |
Despite the strong focus on security, curl 8.21.0 introduces a limited number of new features. These include named glob support for file uploads, HTTP/3 proxy CONNECT and MASQUE CONNECT-UDP capabilities, and SHA256 host key support in libssh.
The release also signals the phasing out of several legacy features and components, including NTLM, SMB, TLS-SRP, and internal cryptographic implementations, in favor of a leaner, more secure codebase.
With a total of 206 documented vulnerabilities in curl’s history, this release emphasizes the increasing scrutiny of widely used networking libraries.
Organizations relying on curl and libcurl are strongly encouraged to upgrade promptly to mitigate potential risks, especially in environments using proxy authentication, HTTP/2, or SSH-based transfers. The next scheduled release is anticipated on September 2, 2026, following an extended development cycle.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
