curl 8.21.0 Patches Record 18 Vulnerabilities in Single Release On June 24, 2026, the curl project released version 8.21.0, addressing a record 18 security vulnerabilities the highest number fixed in a single update for the widely used data transfer tool. This milestone brings the total number of publicly disclosed curl vulnerabilities to 206 since the project’s inception. The update includes fixes for critical issues such as credential leakage, memory corruption in WebSocket handling, and use-after-free (UAF) vulnerabilities in HTTP/2 and socket callbacks. Among the patched flaws, four were rated Medium severity, including: - CVE-2026-8925: A SASL double-free bug leading to memory corruption during authentication. - CVE-2026-8927: An environment-set cross-proxy Digest auth state leak exposing credentials. - CVE-2026-9079: A stale proxy password leak risking unintended credential reuse. - CVE-2026-11856: A cross-origin Digest authentication state leak allowing unauthorized access. The remaining 14 vulnerabilities were classified as Low severity but still pose risks, such as denial-of-service (DoS) via WebSocket memory exhaustion (CVE-2026-11586), SSH host verification bypasses (CVE-2026-9547), and HTTP/3 data exposure (CVE-2026-9545). Other fixes address connection reuse flaws, QUIC UDP datagram loops, and persistent CA trust issues. Despite the security focus, the release introduces new features, including named glob support for URL patterns, HTTP/3 proxy CONNECT, and SHA-256 host public key support via libssh. It also deprecates HTTP/2 stream dependency tracking, NTLM, SMB, and TLS-SRP support, with plans to remove them in future versions. The next curl release is scheduled for September 2, 2026, following a two-week extension to the development cycle. Organizations relying on curl or libcurl are advised to upgrade immediately to mitigate risks from credential exposure and memory corruption.

Critical libssh2 RCE Vulnerability (CVE-2026-55200) Exploitable via Public PoC A proof-of-concept (PoC) exploit for CVE-2026-55200, a critical remote code execution (RCE) vulnerability in libssh2, has been released, heightening the risk of attacks against unpatched systems. The flaw affects libssh2 versions up to and including 1.11.1, stemming from an unchecked `packet_length` field in the `ssh2_transport_read()` function. This oversight allows attackers to trigger a 32-bit integer wrap, leading to undersized heap allocations and out-of-bounds writes during packet processing. The PoC, published under the exploitarium repository, includes a C11 verifier demonstrating how a crafted `packet_length` (e.g., `0xffffffff`) can force a tiny memory allocation while retaining a large logical packet size. This mismatch enables subsequent operations to overflow the buffer, corrupting adjacent heap structures. The repository also provides a malicious Python-based SSH server that delivers a malformed packet to exploit vulnerable libssh2 clients without authentication or user interaction, aligning with the vulnerability’s CVSS 9.2 severity rating. Given libssh2’s integration into tools like curl, backup agents, firmware updaters, and embedded appliances, any software linking the library and connecting to untrusted SSH endpoints is at risk. The PoC includes a local RCE harness that models the exploit’s allocation-to-control pattern, confirming code execution feasibility though real-world exploitation depends on target-specific factors like binary layout and mitigations. The upstream fix, introduced in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, enforces a strict guard against oversized `packet_length` values. However, no new libssh2 release containing the patch has been widely announced, and downstream projects are still backporting fixes. Organizations are advised to identify and patch affected software while restricting connections to untrusted SSH servers.