Wednesday 14th October 2026

Local Packages

• Updated curl to 8.23.0:

  • lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK

  • SMB: Drop support

  • tool_cb_wrt: Inject the no-clobber number before the extension

  • tool_cb_wrt: Try up to .9999 when no-clobbering

  • apple-sectrust: Check ocsp copy alloc

  • apple: Shorten versions in '__builtin_available()' calls

  • apple: Sync hash init calls, add comments
  • apple: Sync up version guard macro style
  • base64: Avoid repeated input loads when encoding
  • base64: Optimize decode lookup table and quantum loop

  • build: Convert HAS_TIME_T_UNSIGNED to a compile-time check

  • build: Drop 'HTTP_ONLY' option

  • capsule: Reject a capsule that can never be buffered

  • cf-h1-proxy: Reset chunk state on new request

  • cf-h1-proxy: Stricter status line parsing

  • cf-https-connect: Re-arm the timer for the hard eyeballs timeout

  • cf-ngtcp2-cmn: Fix possible '-Wdeclaration-after-statement'

  • cf-ngtcp2-proxy: Check for stream close on rx win update

  • cf-ngtcp2-proxy: Fix rx flow control

  • cf-socket: Adjust NO_SYN_RETRANSMISSIONS for older Windows

  • cf-socket: Clamp keepalive seconds-to-milliseconds conversions

  • cfilters: Fail a send that reports more written than requested

  • clang-tidy: Merge nested 'if()'s

  • cmake/Find*: Drop deprecated compatibility config variables

  • cmake: Enable C++ library for GCC in AWS-LC/BoringSSL static builds
  • cmake: Link llvm stdc++ lib to AWS-LC/BoringSSL-specific feature detections only

  • config2setopts: Always set the security options for SCP/SFTP (CVE-2026-86410)

  • config2setopts: Rename define for maximum cookie header length

  • conncache: Avoid evicting connect-only connections
  • conncache: Never discard a connection still in use
  • conncache: Remove bundle dest
  • connect: Do not busy-loop in blocking connect without a timeout
  • connect: Keep IP info and connect time when connect fails

  • connectdata: Use less curltime

  • cookie: Accept and ignore empty property names in Set-Cookie

  • cookie: Accept and ignore values for 'secure' and 'httponly'

  • cookie: Accept slightly longer lines in cookie jars (CVE-2026-92386)

  • cookie: Cookies for a PSL domain from jar just limits tailmatch

  • cookie: Ignore individual cookie errors when loading (CVE-2026-86412)

  • cpool: Do not use admin handle for conn lookup

  • cshutdown: Make it smaller

  • cshutdown: Use ptrarray instead of llist

  • curl-openssl.m4: Sync LibreSSL detection method with rest of forks

  • curl_addrinfo: Drop redundant parentheses

  • curl_easy_send/recv: Check pointer arg

  • curl_fopen: Restore the uid and gid checks

  • curl_formadd.md: Mention the strlen() for names as well

  • curl_multi_perform: Documentation update

  • curl_setup.h: Drop compatibility raw C flag 'ENABLE_IPV6'

  • CURLINFO_EFFECTIVE_URL.md: Mention a short lifetime

  • CURLOPT*ISSUERCERT*: Not verified cryptographically

  • CURLOPT_POSTFIELDSIZE.md: Improve wording

  • CURLOPT_SHARE.md: Remove bad explanation for cookie sharing

  • CURLOPT_SSL_CTX_FUNCTION.md: Client cert caveats

  • curlx_fopen: Add macro to cast file mode

  • cw-out: Avoid O(n^2) work while buffering paused output

  • cw-out: Recheck callbacks for each call

  • cw-pause: Fix O(N^2) list traversal in cw_pause_flush

  • DEPENDENCIES.md: Fix release date for valgrind 3.0.0 to 2005-08-03

  • DEPRECATE.md: Reflect SMB removal

  • DEPRECATE: Common Name support in TLS certificates for OpenSSL

  • digest: Check peer equality for staleness
  • digest: Fix maximum length quoted value parsing

  • digest: Parse without storing 'value' in local buffer

  • digest: Quote the digest-uri param as well

  • dnscache/conncache tweaks
  • dnscache: Check hostname on lookup
  • dnscache: Compare full hostnames when lookup keys are truncated

  • docs: Add the missing .html to the url-encode book link

  • docs: Document and align the blocking situations

  • docs: Note CAINFO/SSL_VERIFYPEER/SSL_VERIFYSTATUS effect on LDAP

  • docs: SSL session import/file updates

  • doh: Reject undersized HTTPS RDATA

  • dynhds: Check size overflows

  • dynhds: Grow header array geometrically

  • easy: Change event pollset construction

  • easy: Duplicating a zero byte memory area needs no malloc

  • easy: Make ca_cache_timeout standalone

  • easy: Validate buffer pointer in curl_easy_recv and curl_easy_send

  • ECH: Rework config, add test cases
  • escape: Polish encoding and decoding for speed

  • escape: Use hex-pair lookup in curl_easy_escape

  • examples: Clean up crawler link parsing resources

  • fnmatch: Replace recursive matcher with iterative greedy algorithm

  • formdata: Reject a negative content length in curl_formadd

  • ftp: Require TLS on the data connection for implicit FTPS

  • ftp: Tighten use_ssl check for conn reuse

  • ftp: URL encode file names when wildcarding

  • ftplistparser: No more overwriting set.write_func (CVE-2026-92388)

  • ftplistparser: When wildcarding, skip files with slashes

  • ftpserver.pl: Fix warnings when running test 804

  • getinfo: Make sure CURLINFO_EFFECTIVE_URL does not contain creds (CVE-2026-94266)

  • getinfo: Make sure CURLINFO_REDIRECT_URL does not contain creds

  • getparam: Switch off CONNECT headers when using -J

  • glob: Reduce the number of allocations for URLs that don't need globbing

  • global_init: Tidy up, simplify, fix issues

  • gnutls: Hardening (CVE-2026-107928)

  • GnuTLS: Remove our own OCSP signature verification
  • gtls: No early return on verify fail

  • h3-proxy: Teardown fix

  • happy eyeballs: Bound work from many duplicate/failing addresses

  • hash: Change key arguments to const

  • hash: Vary bucket placement across process runs

  • headers: Avoid O(n^2) rescans in curl_easy_nextheader()

  • hsts: Cap max-age to two years (CVE-2026-87863)

  • hsts: On load, only remove exact duplicates (CVE-2026-87862)

  • HTTP-CONNECT: Do not react to 401 responses (CVE-2026-86414)

  • http2: Changes in error handling

  • http2: Don't send a CURLE_SEND_ERROR after a valid http2 response

  • http2: Fix reset after 1xx response

  • http2: Init some callbacks for HTTP/2 push easy handles
  • http2: Initialize URL handle for server pushes
  • http2: Limit trailers and headers count

  • http2: Update a refused stream's error after GOAWAY

  • http2: Use stream in userdata

  • http: Abide to close-rules when transfer-encoding off

  • http: Ignore Proxy-Authenticate unless the response comes from a proxy

  • http: Only enable Negotiate/NTLM to allowed origins (CVE-2026-94265)

  • http: Reject empty header names
  • http: Reject resumed uploads

  • http_aws_sigv4: Fix the s3express service name

  • http_chunks: Accept exactly 17 characters chunk-size

  • http_chunks: Limit trailers size

  • httpsig-key.md: Correct the generating Ed25519 keys commands

  • httpsrr+ech: Check target and port

  • if2ip: Check interface name case sensitively

  • imap: Close the connection on premature done instead of finalizing
  • imap: Compare selected mailbox names case-sensitively
  • imap: Do size checks using 64-bit math

  • inet_pton: Reject a colon that ends an IPv6 address

  • IPFS.md: Replace sunset link, allowlist another one to avoid 'mdlinkcheck' hang

  • KNOWN_BUGS: Drop the curl-config private details entry

  • KNOWN_BUGS: Drop the empty error buffer entry, it no longer happens

  • ldap: base64-encode a non-SAFE DN and reject a control-byte type name

  • ldap: Tidy up variable scope, merge nested #ifs

  • lib557: Exclude three floating point test cases for VS2013 and earlier

  • lib: Connection shutdown, clean up code
  • lib: Make private functions static and remove unused code
  • lib: Reject internal handles in the multi/easy public API

  • lib: Replace 'CURLX_FILE_MODE()' with 'mode_t' cast

  • libssh2: Match hashed known_hosts entries by host (CVE-2026-87865)

  • libssh2: Skip repeat checkp() for already-absent hashed key types

  • libssh: Work with empty priv_key

  • mbedtls: Fix ticket handling
  • mbedtls: Pass correct length for PEM/DER key blobs
  • mbedtls: Resend length check

  • mdlinkcheck: Pass '--retry-max-time' to avoid server-controlled long retry times

  • mime: Bound Curl_mime_duppart() recursion depth

  • mime: Bound Curl_mime_prepare_headers() recursion depth

  • mime: Do curl_mime_free() non-recursively (CVE-2026-92391)

  • mprintf: Acknowledge %F

  • mprintf: Avoid scanning strings twice for unbounded %s

  • mprintf: Make mprintf() and mfprintf() return -1 on error

  • mprintf: Stage output and emit it in runs

  • mprintf: Use size_t width for the bare Windows %I modifier

  • mqtt: Drain queued output before advancing the state machine

  • mqtt: Remaining length check for 32-bit systems

  • mqttd: Work around bogus VS2019 32-bit compiler warning

  • mulit_ev: Remove socket references on forget

  • multi-event: Fix timeout of pending transfers

  • multi: Adjust the clean-up order in multi_done (CVE-2026-92392)

  • multi: is_finished() fix

  • multi: Reduce struct size with small clean-ups
  • multi: Remove redundant completion message list
  • multi: Store timeout epoch as whole seconds

  • multi_ntfy: Fix handling of more than 128 notifications in a batch

  • multi_ntfy: Recheck callback on dispatch

  • multi_ntfy: Replace enabled bitset with inline flags

  • multihandle: Some easy shrinks

  • netrc: Empty quoted values now produce a valid empty string

  • netrc: Survive comment-only .netrc file

  • ngtcp2: Shrink max sendbuf

  • ngtcp2: Use stream in userdata

  • openldap: Hand it a dup'd socket, not curl's own

  • openssl/gtls: Reject CRLfile with native CA store, matching rustls
  • openssl: Fix OpenSSL v4.1 no-deprecated build
  • openssl: Hardening
  • openssl: Support X509 store caching when CApath is configured
  • openssl: Use non-deprecated API for MD5/MD4

  • os400: Document curl_formadd_CCSID multi-chunk peculiarity

  • os400: Restore HAVE_FCHMOD

  • os400: Use correct free function

  • ossl_verifyhost: Remove assumption of null-termination of ASN1_STRING

  • output-dir.md: Expand on its behaviour

  • parsedate: Find day names, months and time zones faster

  • parsedate: Remove the unused leading three letters

  • parsedate: Validate NULL date pointer in curl_getdate

  • peer: Compare zoneid case sensitively

  • peer: Parsing a zoneid as number fix

  • peer: Preserve ipv6 props from "connect-to"

  • perf-tests: Output two-digital decimals always

  • pingpong: Add a max loop counter for Curl_pp_readresp (CVE-2026-92387) -* pingpong: Guard sendleft against a send reporting more than requested

  • pingpong: Schedule server response timeouts for the socket API

  • pytest: Adjust threshold in test_20_11_crazy_pings for arm64

  • pytest: Check server status without ssl verify

  • pytest: Fixture fixes

  • pytest: Set 'PerSourcePenalties no' when sshd supports it

  • pytest: Silence pytest warnings

  • pytest: Start all servers early

  • retry.md: Clarify that the server can override retry delay time

  • Revert "setopt: clear the 'custom' CA booleans when set to NULL"

  • rtsp: Accept a Content-Length body on methods that expected none

  • rtsp: Do not send a learned session id to another origin

  • runtests: Add extra room for mininum number of tests in sliced jobs

  • runtests: Added runnernums in order to have O(1) lookup

  • runtests: Unset 'CURL_MEMDEBUG' for curl requests made to the CI API

  • rustls: Break recv loop on empty plain text

  • rustls: Consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB

  • schannel: auto_client_cert conn matching (CVE-2026-86415)

  • schannel: Clear borrowed sslContext on close

  • schannel: Fix '-Wextra-semi-stmt' with clang and extra debug enabled

  • schannel: Fix compiler warning '-Wstrict-aliasing' in ALPN code

  • schannel: Fix guard for old MSVC workaround

  • schannel: Handle empty tokens during renegotiation

  • schannel: Retain close_notify records across send retries

  • sectrust: Add guards for rest of Apple OS flavours

  • share link: Forget connection

  • socketpair: Fix accept loop

  • socketpair: Use 'pipe2()' on Apple OSes (requires SDK 27)

  • socks: Support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH

  • socks: Track SOCKS5 authentication per socket, not per connection

  • socksd: Count connections per test, widen the method2 sentinel

  • ssl: Dedup ssl_fsslctx

  • ssls: Validate input arguments in import, export and unpack

  • strparse: Speed up number parsing

  • sws: Fix connection-monitor for connections closed before a request
  • telnet: Make it work through proxy tunnels
  • test 1605: Move from unit to libtest

  • test/servers.pm: Restrict h2/3 port reuse

  • test1119, 1167: Disable MSYS2 argument conversion

  • test1399: Improve reliability

  • test1679: Unset 'SSL_CERT_FILE', use 'TESTNUMBER'

  • test2007: Bump to use SHA256 public key hash (was: MD5)

  • test2007: Set 'MSYS2_ARG_CONV_EXCL' to avoid flaky failures

  • test2072: Enable on Cygwin/MSYS2

  • test428: Skip when running on older MSYS2 versions

  • test: Restore the old test 1609 as 3271

  • testcurl.pl: Drop support for building c-ares from embedded source tree

  • tests/http: Use @classmethod when appropriate

  • tests: Add SFTP connection reuse tests
  • tests: Clean up Python test code
  • tests: Fix typos in a comment

  • tests: Require valgrind 3+ (2007-08-03)

  • tftp: Verify direction in a few places (CVE-2026-92389)

  • tool: (re)set SSL verification in --libcurl output

  • tool: Add Unicode and long-filename support to '--create-dir' (Windows)

  • tool: Buffer headers before remote filename selection (CVE-2026-92390)

  • tool: Handling of "synthetic" errors

  • tool_doswin: Recognize superscript numbers as reserved

  • tool_easysrc: Reset the handle between --next operations

  • tool_getparam: Do not print the value of a redacted argument

  • tool_getparam: Restore --socks5-gssapi-service

  • tool_help: Guard category[2] access when category is bare "-"

  • tool_ipfs: Keep the path percent-encoded when rewriting to the gateway

  • tool_operate: Clear the retry flag when the output file fails

  • tool_util: Add Unicode support to 'tool_execpath()'

  • u8_strset, u32_ptrset: Fix boundaries handling

  • uint-bset: Skip unused slots when counting

  • uint-table: Add remove-max precaution

  • unit1399: Check microsecond precision across redirects

  • unit1664: Add workaround for VS2019 16.3 - VS2022 17.4 x64 miscompile

  • url: Check syntax before applying default-protocol

  • url: CURLOPT_INTERFACE fix connection reuse match (CVE-2026-107929)

  • url: Match connections without force reuse and candidates (CVE-2026-87861)

  • url: ntlm/negotiate, prohibit connection reuse on follows (CVE-2026-86413)

  • urlapi: Make curl_url_dup() copy the guessed_scheme flag

  • urlapi: Normalize legacy numeric IPv4 hosts set via CURLUPART_HOST

  • urlapi: Return NULL from curl_url_dup() when given a NULL handle

  • urlapi: Run the urlparser perf test faster

  • urldata: Remove conn->given

  • urldata: Remove ssl_primary_config from easy handle

  • urldata: Shrink connectdata negotiate states

  • vdns: Announce resolver start before the HTTPS RR query is sent

  • vquic: Fix preprocessor check for old Darwin versions

  • vquic: Use 'CURLX_FILE_MODE()' in 'Curl_qlogdir()'

  • vssh: Do not busy-loop in blocking state machine without a timeout

  • vtls: Fix Curl_cert_hostcheck when the pattern is not a C string

  • vtls_scache: Remember lock state locally

  • warnless: Dedupe Intel compiler warning suppression pragmas

  • wcurl: Import v2026.10.12

  • websocket: Auto PONG with client reader fix

  • websocket: Error on EOS with incomplete frame
  • wolfssl: Remove BIO destroy callback

  • ws: Check pointer args in curl_ws_recv

  • ws: Do not auto-pong in raw mode

  • x509: Stricter parsing (CVE-2026-87866)

Tuesday 13th October 2026

Fedora Project

• Updated gtorrentviewer (0.2b), perl-Archive-Any-Lite (0.11), perl-Authen-DigestMD5 (0.04) and perl-autobox-dump (20090426.1746) in Rawhide to use the %{make_build} and %{make_install} macros in the package build

• Updated perl-Business-ISBN-Data to 20261013.001 in Rawhide:

  • Data update for 2026-10-13

• Updated perl-Module-Extract-VERSION to 1.123 in Rawhide:

  • Try harder to handle version->declare (GH#21)

Local Packages

• Updated perl-Module-Extract-VERSION to 1.123 as per the Fedora version

Saturday 10th October 2026

Fedora Project

• Updated perl-IO-Compress to 2.225 in Rawhide:

  • Update maintainer email address

  • Fix inefficient and unbounded code for reading gzip Name and Comment fields (GH#86)

  • Add newStreamHook (GH#84)

  • Fix typo in Changes file

• Updated perl-IO-Compress-Lzma to 2.225 in Rawhide:

  • Update maintainer email address

Local Packages

• Updated perl-IO-Compress to 2.225 as per the Fedora version

• Updated perl-IO-Compress-Lzma to 2.225 as per the Fedora version

Friday 9th October 2026

Fedora Project

• Updated ansible-collection-community-libvirt to 2.4.0 in Rawhide:

  • This is a minor release of the community.libvirt`' collection

  • Replace the deprecated 'ansible.module_utils.six' compatibility shims with their Python standard library equivalents

  • virt_volume: Fixed capacity/allocation unit parsing to recognize all unit strings documented by libvirt's storage volume XML format (e.g. GiB, MiB, KB, TB), instead of silently treating unrecognized units as a multiplier of 1 and attempting a bogus resize (GH#281)

• Branched and built perl-Crypt-SmbHash (0.12) for EPEL-10.3 and EPEL-10

• Updated perl-B-Hooks-OP-Annotation (0.44) in Rawhide to use the %{make_build} and %{make_install} macros during the build

• Updated perl-Compress-Raw-Bzip2 to 2.225 in Rawhide:

  • Update maintainer email address

• Updated perl-Compress-Raw-Lzma to 2.225 in Rawhide:

  • Update maintainer email address

• Updated perl-Compress-Raw-Zlib to 2.225 in Rawhide:

  • Update maintainer email address

  • Changes: Correct typo in date

• Updated perl-Package-Generator (1.106) in Rawhide to conditionalize the optional test dependency Params::Util (PR#2)

Local Packages

• Updated ansible-collection-community-libvirt to 2.4.0 as per the Fedora version

• Updated perl-Compress-Raw-Bzip2 to 2.225 as per the Fedora version

• Updated perl-Compress-Raw-Lzma to 2.225 as per the Fedora version

• Updated perl-Compress-Raw-Zlib to 2.225 as per the Fedora version

Thursday 8th October 2026

Fedora Project

• Cleaned up and rebuilt perl-Class-Std (0.013) in Rawhide

• Updated perl-Child (0.013), perl-Class-Loader (2.03), perl-Compress-LZF (3.8), perl-Convert-BinHex (1.125), perl-Convert-TNEF (0.18), perl-Crypt-Blowfish (2.14), perl-Crypt-Cracklib (1.7), perl-Crypt-IDEA (1.10), perl-Crypt-SmbHash (0.12) in Rawhide to use the %{make_build} and %{make_install} macros during the build