curl 8.21.0 Fixes 18 Security Flaws, Including a 25-Year-Old libcurl Bug

curl 8.21.0 has been released with 18 security fixes, the largest number of vulnerabilities ever patched in a single curl release. One of those bugs, CVE-2026-8932, dates back to curl 7.7, which shipped on March 22, 2001.

The release was announced by curl founder and lead developer Daniel Stenberg in the curl 8.21.0 release post on June 24, 2026. Stenberg said the 18 new vulnerabilities set a project record for one release and for the number of vulnerabilities published in the same calendar year.

The oldest fixed issue is not a flaw in the curl command-line tool itself. The official CVE-2026-8932 advisory says the bug affects libcurl, the library embedded in many applications and products that use curl’s transfer engine.

CVE-2026-8932 affected libcurl connection reuse

CVE-2026-8932 is an mTLS connection reuse bug. libcurl could reuse an existing connection even after certain client certificate or private key settings had changed, when that change should have stopped reuse.

The flaw sits in how libcurl compares connection settings before deciding whether an existing connection is safe to reuse. Some TLS options related to client certificates were not included in the matching checks, which made some connections match too broadly.

curl rates the vulnerability as Low severity and links it to CWE-305, Authentication Bypass by Primary Weakness. The practical risk depends on how an application uses libcurl, mTLS, client certificates and connection reuse.

Item	Details
CVE	CVE-2026-8932
Component	libcurl
Issue	Incomplete mTLS configuration matching during connection reuse
Severity	Low
Affected versions	curl 7.7 through 8.20.0
Fixed version	curl 8.21.0

Why a low-severity bug still matters

The age of CVE-2026-8932 makes it notable. The bug was introduced with curl 7.7 in March 2001 and remained present until it was fixed in curl 8.21.0 in June 2026.

The curl security advisory says the issue does not affect the curl command-line tool. It also notes that libcurl is used by many applications, often without users knowing it is present.

That distinction matters for patching. A developer may update the curl command on a server and still have separate applications, SDKs, appliances, containers or embedded products that use older libcurl builds.

curl 8.21.0 patches 18 CVEs

The 18 security fixes include four medium-severity vulnerabilities and 14 low-severity vulnerabilities. They cover authentication state handling, connection reuse, proxy credential handling, HTTP/2, HTTP/3, WebSocket behavior, SSH verification and other protocol areas.

The release announcement lists the medium-severity issues as CVE-2026-8925, CVE-2026-8927, CVE-2026-9079 and CVE-2026-11856. The remaining 14 issues carry low severity ratings.

Security teams should treat the release as a broad maintenance update, not just a single historic CVE fix. The vulnerability list touches several code paths that matter in enterprise and embedded use cases.

CVE	Severity	Short description
CVE-2026-8925	Medium	SASL double-free
CVE-2026-8927	Medium	Cross-proxy Digest authentication state leak
CVE-2026-9079	Medium	Stale proxy password leak
CVE-2026-11856	Medium	Cross-origin Digest authentication state leak
CVE-2026-8286	Low	Wrong STARTTLS connection reuse
CVE-2026-8458	Low	Wrong connection reuse for different services
CVE-2026-8924	Low	Trailing-dot domain super cookie
CVE-2026-8926	Low	Password leak with .netrc and user in URL
CVE-2026-8932	Low	Incomplete mTLS config matching in connection reuse
CVE-2026-9080	Low	Use-after-free after pause in socket callback
CVE-2026-9545	Low	HTTP/3 early data exposure
CVE-2026-9546	Low	Old referer data disclosure
CVE-2026-9547	Low	SSH improper host validation
CVE-2026-10536	Low	HTTP/2 stream dependency tree use-after-free
CVE-2026-11352	Low	QUIC zero-length UDP datagrams busy-loop
CVE-2026-11564	Low	Native CA trust persistence issue
CVE-2026-11586	Low	WebSocket Auto-PONG memory exhaustion
CVE-2026-12064	Low	SSH verification skipped by proto-default

AI-assisted research triggered wider attention

The unusually large security release followed a sharp rise in curl security reports. In May 2026, Stenberg wrote that Anthropic’s Mythos model had found one confirmed curl vulnerability planned for the 8.21.0 release.

AISLE later said its platform found six of the 18 CVEs fixed in curl 8.21.0, including CVE-2026-8932. The AISLE report also said the oldest issue had been present since curl 7.7, making it the oldest curl security issue reported so far.

The important point for defenders is not who found each bug. The larger lesson is that mature and heavily audited infrastructure can still contain long-lived edge-case flaws, especially in connection reuse, authentication state and protocol-specific behavior.

Several issues affect libcurl more than direct curl users

curl is both a command-line tool and a software library. Many people think of curl as a terminal command, but libcurl sits inside operating systems, developer tools, CI/CD systems, package managers, appliances, embedded products and commercial applications.

AISLE says several of the issues it reported affect libcurl applications rather than the curl command-line tool. That makes remediation harder because end users may not know which products bundle libcurl or when those products will ship updated builds.

Organizations should not assume a workstation or server is safe just because the system curl package has been updated. Software bills of materials, container scans and vendor advisories may be needed to find older libcurl copies.

• Check operating system packages for curl and libcurl updates.
• Scan containers and base images for bundled libcurl versions.
• Review CI/CD runners, build tools and developer images.
• Ask vendors whether products embed libcurl 8.20.0 or earlier.
• Prioritize systems that use mTLS, proxies, Digest authentication, HTTP/2, HTTP/3 or SSH transfers through libcurl.

New features and removals in curl 8.21.0

curl 8.21.0 focuses heavily on vulnerability fixes, but it still adds several changes. The official curl changelog lists named glob support in output filenames for upload references and HTTP/3 proxy CONNECT and MASQUE CONNECT-UDP support using ngtcp2 QUIC.

The release also removes HTTP/2 stream dependency tracking and drops CURLAUTH_DIGEST_IE support. It adds support for SHA256 host public keys with the libssh backend.

The changelog also lists 276 bug fixes and more than 500 commits in this cycle. That makes curl 8.21.0 both a security release and a large maintenance release.

Change type	Details
Security fixes	18 CVEs fixed
Bug fixes	276 bug fixes listed for the release
New curl option	One new curl command-line option
Feature addition	Named globs in upload output filenames
HTTP/3 update	Proxy CONNECT and MASQUE CONNECT-UDP support
Removed support	HTTP/2 stream dependency tracking and CURLAUTH_DIGEST_IE

Upcoming removals need planning

The release notes also warn about planned removals. The project lists local crypto implementations, NTLM, SMB and TLS-SRP support as upcoming removals.

Those planned changes matter for older enterprise environments. Some legacy systems still depend on NTLM, SMB or older authentication paths, and teams should test their curl and libcurl usage before those features disappear.

The curl release notes give developers a clear reason to audit old transfer logic now. Waiting until deprecated features disappear can break integrations during future upgrades.

Who should update first

All users should move to curl 8.21.0 or a vendor-patched build, but some environments deserve faster attention. Systems using libcurl for authentication-heavy workflows face the most direct exposure from several of the fixed issues.

Applications that use client certificates, proxies, Digest authentication, SASL, SSH transfers, HTTP/2, HTTP/3 or WebSocket features should move higher in the patch queue. Embedded and appliance vendors should also check whether they ship libcurl internally.

The AISLE analysis highlights why embedded libcurl matters. Many users rely on libcurl indirectly through another product, which means the real patch path may depend on software vendors, appliance makers or container maintainers.

• Upgrade curl and libcurl to version 8.21.0 where possible.
• Apply vendor patches when direct upgrades are not available.
• Rebuild applications that statically link older libcurl versions.
• Refresh container images and CI runners that include libcurl.
• Check third-party products that bundle curl or libcurl internally.
• Review mTLS and proxy-heavy applications for higher priority patching.

Bottom line

curl 8.21.0 is one of the project’s most important security releases. It fixes 18 vulnerabilities, including a libcurl mTLS connection reuse bug that remained in the codebase for more than 25 years.

The headline number is striking, but the practical response is straightforward. Developers, security teams and vendors should identify every place curl and libcurl appear, then update to curl 8.21.0 or an appropriate patched vendor build.

The most difficult work may not be updating the visible curl binary. It will be finding embedded libcurl copies inside products, containers, SDKs and build systems that users rarely inspect directly.

FAQ