Paul's Blog Entries for September 2026
Tuesday 1st September 2026
Fedora Project
Updated perl-CPAN-Meta to 2.150015 in F-45 and Rawhide:
Local Packages
Updated dovecot to 2.4.5:
CVE-2026-27852: Messages with a huge number of From/To/Cc/etc. email addresses could result in excessive memory usage
CVE-2026-33263: Submission: Login service crashes with panic once mail_max_userip_connections limit is reached
CVE-2026-33604: The SMTP outbound dot-stuffing mechanism does not properly escape dots following a bare \r in message bodies, potentially allowing spoofed emails via malicious end-of-DATA injection
CVE-2026-33606: Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration
CVE-2026-33607: IMAP LIST command could be used to cause excessive CPU usage
CVE-2026-40014: IMAP THREAD command could have used excessive amount of CPU processing a single email with a massive number of Message-IDs in References header
CVE-2026-40015: Invalid IMAP command sent to imap-hibernate process might crash it
CVE-2026-40017: IMAP THREAD command could have used excessive amount of CPU processing emails with a large number of specially crafted Message-IDs in References header
The fix requires a new dovecot.index.thread file format, which is enabled only after setting dovecot_storage_version or newer; this rebuilds the index, so it will cause some extra CPU usage and extra metacache disk IO usage but it shouldn't cause (much) extra object storage IO, because all the fields should be coming from dovecot.index.cache
CVE-2026-40203: When IMAP COMPRESS=DEFLATE was enabled, an attacker could send mails into a victim's mailbox and observe network traffic to determine whether a secret message matched a known string by comparing compressed response sizes (a CRIME-style attack); the fix resets the compression dictionary after each IMAP command, preventing information from leaking between commands
CVE-2026-40205: If multiple OAUTH scopes were required, this could have been only partially enforced with certain configurations
CVE-2026-4200: XCLIENT FORWARD allows to forward key only passdb fields without the "forward_" prefix that allows connections from trusted networks to set nopasswd field, which allows to skip the authentication
CVE-2026-42391: Pre-login IMAP ID command could have used excessive amount of memory, causing the process to become killed and disconnecting all the other IMAP connections being proxied by the process; or alternatively it could have caused excessive CPU usage, slowing down all the other IMAP connections being proxied by the process
CVE-2026-42392: If URLAUTH is enabled, sending an invalid IMAP URLFETCH can result in an untagged NO response containing uninitialized memory, potentially leaking sensitive data
CVE-2026-42393: doveadm password length or API key length could still be determined via timing based attacks
CVE-2026-42395: XCLIENT FORWARD command from login_trusted_networks could have been used to cause login processes to crash
CVE-2026-52681: Sieve resource usage (sieve_max_cpu_time) was tracked in the active Sieve binary; switching to a different active binary could have been used to reset (bypass) the resource usage
CVE-2026-52687: Using IMAP COMPRESS ZSTD command can cause excessive memory usage in imap-login process, possibly making it reach vsz_limit and kill all the connections being served by the process; fixed by disabling COMPRESS command with all other compression algorithms than the standard DEFLATE
CVE-2026-73208: In oauth2, scope/aud checking was done with JWT tokens; now it requires all scopes
CVE-2026-73209: Sending IMAP COMPRESS package containing zero-length frames crashes imap or imap-login process
auth: SIGHUP no longer flushes the passdb cache and SIGUSR2 no longer logs cache statistics; use "doveadm auth cache flush" and the new "doveadm auth cache status" instead
auth: The OTP authentication mechanism, the {OTP} password scheme and the passdb set-credentials support have been removed; they were unmaintained and unused (this also drops the passdb_sql_update_query setting)
config: doveconf no longer prints a flat global setting when a top-level named filter overrides the same setting
doveadm: The doveadm protocol has been bumped to v1.4; the server uses the newer multiplex stream format with clients supporting it, whilst older clients keep working unchanged
imap: Change imap_compress_on_proxy default to yes
lib-dict-extra: Increase dict client request timeout from 30s to 65s, so it stays above the SQL/Cassandra query timeout
lib-http: HTTP requests are now parsed strictly: obsolete line folding (obs-fold) and a bare LF line terminator are rejected; both are request desynchronization/smuggling risks (HTTP responses are still parsed leniently)
lib-storage: A '~' in a mailbox name is now escaped only when it is at the beginning of the mailbox name, not at the beginning of every hierarchy part; directories written by older versions are migrated automatically while listing mailboxes
lib-var-expand: Add %{time:unix} provider and the epoch, from_epoch, date, iso8601 and escape filters; deprecates the old time providers
lib-var-expand: The safe filter must now be the last filter in the chain
master: Increase the timeout after config reload before killing still running old processes from 6s to 35s, so that lib-master can stop them gracefully first
- config: Support heredoc syntax for multi-line setting values:
key = <<EOD ... EOD
doveconf now outputs inline SET_FILE contents (e.g. ssl_ca) using heredoc instead of the "inline:" prefix; the "inline:" form is still accepted
configure: Build imap-hibernate also when only kqueue notify is available
doveadm: Add "doveadm auth cache status" command, with --reset for clearing the counters
doveadm: dump - List all supported dump types, and print the key type also for KEM and unsupported keys
fts-flatcurve: Add support for phrase searching; this fixes false positives where the searched words existed, but not as a phrase
fts-flatcurve: Delete the FTS index directory too when a Maildir mailbox is deleted
imap: Add [THROTTLED] response code to tagged replies when a plugin has throttled the command
last-login: Add last_login_dict_fields setting for updating multiple dictionary fields at login
lib-dcrypt: Add ML-KEM-512/768/1024 support with OpenSSL 3
lib-dcrypt: Support AEAD with Dovecot key encryption
lib-settings: Expand %{variables} also in strlist and boollist keys
lib-sql: sqlite - Add sqlite_busy_timeout setting, default 1s
login-common: Log the destination also when a proxy connection fails
quota: Update quota-clone also when "doveadm quota recalc" is run
Fix building on systems with a signed 32-bit time_t
Fix building with Lua when LUA_LIBS contains linker flags such as -L
- anvil: Fix busy loop eating CPU after an admin socket connection was disconnected
auth: Fix authentication failing after a password change when the passdb cache entry was verified by an auth worker
auth: Fix the credentials scheme of one passdb leaking into the next one during a multi-passdb lookup
auth: oauth2 - Fix losing userdb_* fields during OAUTHBEARER authentication
auth: passwd-file - Fix %{passdb:...} and %{userdb:...} expansion returning garbage or crashing
config: Fix crash in "doveconf -f" for a filter that includes a @group
config: Fix crash when including a default @group into a filter
config: Fix hiding secrets in doveconf output
config: Fix startup failures with some settings containing %{variables}
configure: Fix BUILD_IMAP_HIBERNATE detection
doc: solr-schema-9.xml - Add the mandatory tokenizer class attribute
doveadm: compress-connect - Fix writing server input to a non-blocking stdout
doveadm: fs delete - Fix crash with concurrent async deletes
doveconf: Fix bogus "Multiple settings matched" error when stdout is redirected to a file that already has content
dsync: Fix truncating a mailbox attribute value when it is compared to the local one, e.g. truncating a Sieve script
dsync: backup - Mailbox attributes changed or created only in the destination are now reverted or deleted
fts-flatcurve: Ignore index directory entries that vanish during iteration
- fts: Don't run FTS optimize on forced resync
fts: build-mail - Fix accessing Content-Type header buffer out of bounds
imap-login, pop3-login: Tolerate SASL continuations "+" without a trailing space when proxying authentication
imap: Don't report FETCH output stream errors as "BUG: Unknown internal error"
- imap: Fix hibernation always failing on FreeBSD
imap: Fix panic on GETMETADATA with an invalid UTF-8 mailbox pattern
imapc: Don't send SEEEN/UNSEEN to the remote server when private indexes are used
imapc: Fix SEARCH results pointing at wrong messages after an untagged EXPUNGE
imapc: Fix SORT returning an empty result when search criteria were used
imapc: Fix crash when copying a mail that was already expunged in the source mailbox
imapc: Fix stale SEARCH/SORT results after a STORE in the same session
imapc: Honour imapc_features=no-search also for SORT
imapc: Properly handle search criteria that can be sent to remote server
lib-dcrypt: Don't panic on key algorithms the backend doesn't support
lib-dcrypt: Fix x9.62 ECDSA signatures randomly failing verification
lib-dict-backend: cdb - Fix use-after-free of the returned key
lib-dns-client: Fix handling of a disconnect initiated by the dns-client service
lib-fs: Fix panic in fs_write_stream_abort(), e.g. when the disk is full during FTS indexing
lib-index: Fix "File is already open" error when appending to the transaction log while another process is rotating it; this showed up as "NO [SERVERBUG] Internal error occurred" without any logging
lib-ldap: Fall back to system default CA paths, needed for OpenLDAP built against GnuTLS
lib-mail: istream-binary-converter - Fix heap use-after-free with a bodyless MIME part
lib-mail: message-parser - Fix out of bounds read with an empty preamble, fix skipping the epilogue boundary line, and degrade to a re-parse instead of panicking with an inconsistent cached MIME tree
lib-master: Fix kick reason when the KICK-USER-SIGNAL command arrives late, which logged "Killed with signal 15" instead of "User kicked"
lib-oauth2: jwt - Fix use-after-realloc, guard against an empty body segment and percent-encode bare "." and ".." identifiers
lib-program-client: Fix panic upon irregular termination
lib-settings: Fix sorting of the settings history, which caused changed defaults and renames to be ignored once a plugin registered its own history, if dovecot_config_version has been set to greater than 2.4.0
lib-smtp: Fix assert with an empty broken localpart
lib-smtp: xclient - Reject an invalid HELO parameter with 501
lib-sql: pgsql - Fix binary field values for rows after the first; this mainly affected dict-sql maps with hexblob fields
lib-ssl-iostream: Fix crash at process exit with OpenSSL 4.0
lib-storage: Don't log an error when the client resets the connection while saving a mail
lib-storage: Fix crash when reverting a failed mailbox deletion
lib-storage: Fix decoded size calculation for base64 attachments, which could delete the cache record of a mail with a detached attachment
lib-storage: Fix handling escaped mailbox names in the mailbox list index
lib-storage: Fix rewriting non-NFC subscriptions with mUTF-7 storage names, which caused repeated rename errors
lib-storage: Fix searching flags when the view is not up to date; this broke e.g. a pipelined UID STORE +FLAGS \Deleted followed by UID EXPUNGE
lib-storage: Fix the mailbox vsize header not being repaired when it is corrupted, causing wrong mailbox sizes to be reported
lib-storage: thread - Fix panic when running IMAP THREAD in multiple connections in parallel
lib-var-expand: Reject an empty separator in the index filter, which caused an infinite loop
lib: Fix crash and out of bounds reads when decoding IDN addresses; reachable only with the experimental mail UTF-8 support enabled
lib: ioloop - Fix panic and delayed timeouts when time moves forwards
lib: ostream-multiplex - Fix stalls, busy loops and a panic when streaming data through a multiplexed connection, e.g. IMAP FETCH through a login proxy or TLS connections
login-common: Fix connection hanging if an ostream write failed; this happened at least with HAProxy health check connections
login-common: Fix real_remote_ip being looked up incorrectly
login-common: Reject proxy credentials with ASCII control characters
login-proxy: Fix "doveadm kick" for proxied connections in high-security mode, and log "Kicked by admin" as the reason
maildir: Fix random SEARCH failures when another session concurrently expunges mails
quota: Fix maildir quota dropping to zero after IMAP MOVE or REPLACE
submission-login: proxy - Fix crash and unbounded memory usage with a multi-line or malformed AUTH reply from the backend
Update pigeonhole to 2.4.5:
lib-sieve: sieve_max_cpu_time now defaults to 30s globally, so the limit also applies to MDA delivery; previously, the global default was unlimited and only imap_sieve used 30s (the old defaults are kept for older dovecot_config_version values)
lib-sieve: enotify - The number of notify actions performed during a single script execution is now limited to 10 by default; see the new sieve_notify_max_notifications setting
lib-sieve: enotify - A single "mailto:" notify action is now limited to 8 recipients and 16 additional headers by default; see the new sieve_notify_mailto_max_recipients and sieve_notify_mailto_max_headers settings
imap-filter-sieve: FILTER SIEVE SCRIPT literals larger than sieve_max_script_size are now rejected before the script is read
lib-sieve: Fix stack overflow occurring when a script requires the same extension repeatedly
lib-sieve: encoded-character - Fix integer overflow parsing ${unicode:...} values with 9 or more hex digits
lib-sieve: variables - Fix integer overflow parsing numeric variable index
lib-sieve: regex - Fix panic occurring when more than 8 group values are matched
lib-sieve: ldap - Fix LDAP settings missing from the LDAP storage plugin
managesieve-login: Fix capability reporting when Sieve settings use %variables
Updated perl-CPAN-Meta to 2.150015 as per the Fedora version
Updated perl-Net-DNS to 1.57:
- Resync with IANA DNS parameters registry
EDNS: Add support for MQTYPE-QUERY option
Fix unbounded recursion when re-encoding message with misplaced TSIG (CPAN RT#181125)
UNIX resolver could fail in taint mode (CPAN RT#180773)
Wednesday 2nd September 2026
Fedora Project
Updated perl-Cpanel-JSON-XS to 4.44 in F-45 and Rawhide:
Fix canonical sort infinite loop (GH#252): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer: now checked as 0 or > remaining length
Local Packages
Updated curl to 8.22.0:
- gssapi: Add support for Apple GSS Framework
- hardening: Add API guards
- Add RFC 9421 HTTP Message Signatures support
- spnego: Block NTLM fallback in SPNEGO negotiation
- TLS: Drop support for TLS-SRP
- vquic: Add option to use Apple fast UDP
- altsvc: Continue after unknown parameters
- asyn-thrdd: Retry link-local ipv6 if missing scope id
- autotools: Minor fixes and improvements
build: Always use local 'inet_pton()'/'inet_ntop()' implementations
build: Assume POSIX 'select()' is available
build: Clear 'Require.private' for static-only builds in 'libcurl.pc'
build: Drop 'dirent.h' and 'opendir()' detections on Windows
build: Drop detecting 'gettimeofday()' on Windows
build: Drop superfluous 'STDC_HEADERS' macro
build: Enable thread-safe 'getaddrinfo()' for OpenBSD
- build: Minor debug option message fixes/improvements
build: Require '!NDEBUG' for debug-enabled (a.k.a. development) builds
build: Strip duplicate spaces after 'Libs.private:' in 'libcurl.pc'
build: Strip trailing spaces from 'libcurl.pc'
cd2nroff: Fix backslashes for 4-space indent lines
cd2nroff: Stricter checks for asterisks for italics
cf-ngtcp2-cmn: De-duplicate 'ngtcp2_conn_client_new()' call code
cf-ngtcp2-cmn: initialize new callback pointer for ngtcp2 1.24.0+
cf-socket: Avoid broken NetBSD SOCK_NONBLOCK
cf-socket: Disable TCP SYN retransmissions for localhost on Windows
- cfilters: Fix event-based connection shutdown
- clock: Save one call
cmake/FindLibgsasl: Fix to set 'LIBGSASL_VERSION' with pkg-config detection
cmake: Check libgsasl version at configure time
cmake: Dedupe expressions into local vars in 'cmake_uninstall.in.cmake'
cmake: Fix not to build 'tunits' when 'BUILD_CURL_EXE=OFF'
- cmake: Flatten build tree, tidy up base dir variables
cmake: Minor improvements to 'cmake_uninstall.in.cmake'
- cmake: Optimize OpenSSL fork detection
cmake: Replace 'remove' command with 'rm' and pass arg safely
- cmake: Robustify base path in local file reference
cmake: Stop probing unused 'float.h' for 'STDC_HEADERS'
- cmake: Use built-in variable and target property dump functions with CMake 4.5+
config-riscos.h: Delete hand-crafted RISC OS config header, in favour of autotools
config-win32.h: Drop UWP, c-ares, simplify more
config-win32.h: Limit use to MSVC IDE Project builds
configure: Clarify --enable-debug option
- configure: Fix misleading error messages
configure: Link '-lcrypt32' instead of '-lm' for wolfSSL on Windows
configure: Only check in the watt library if WATT_ROOT is set
- configure: Remove double check for GnuTLS
configure: Set ldap lib to no by default for non-finds
- conncache: Apply multi limits to transfers using a shared pool
- conncache: Conn upkeep/alive: move and enhance
- conncache: Connection alive checks intervals
conncache: Don't assume curl_off_t increment wrap-around
conncache: Guess maxconnects different
- connect: Connection close tweaks
- connect: Only set connect timer on first socket
- connection reuse: Age check
- connection reuse: Check SSL configs when doing a scheme upgrade
connections: Use admin handles only for maintenance (CVE-2026-19931)
- content_encoding: Exact-match the identity transfer-coding token
- content_encoding: Give a clear error on multi-member gzip
cookie: Cookies set for an exact PSL domain is host-only (CVE-2026-82209)
cookie: Improve TAB handling (CVE-2026-80255)
- cookie: Refuse to load cookies set against a PSL domain
CREDENTIALS.md: Remove comment about empty user/pass
ctype: Exclude control bytes from ISPRINT and ISGRAPH
- curl: Help category clean-ups
curl_gssapi: Document/update feature availability
curl_threads: Always use native threads/mutex on Windows
curl_trc: Remove unused expire timers
curl_url_set.md: Expand the CURLU_NO_AUTHORITY description
curl_ws_meta.md: Polish and better vocabulary
CURLOPT_HEADERFUNCTION.md: Document folded header unfolding
CURLOPT_SOCKOPTFUNCTION.md: ALREADY_CONNECTED does not work for HTTP/3
CURLOPT_SSH_*_KEYFILE: Used for setting up, then no more
CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication'
CURLOPT_USERNAME.md: Ambient username caveats
CURLSHOPT_(UN)SHARE.md: Do not modify shares while in use
curlx_inet_ntop: Return 'CURLcode', drop setting 'errno'
curlx_inet_pton: Drop setting 'errno' on error
DEPRECATE.md: HTTP/2 Server Push gets removed in March 2027
dict: Avoid busy-loop in sendf() when the socket is not writeable
- dist: Fix to drop test bundle .c files from the source tarball
dnsd: Fix bounds check in 'read_https_alpn_part()'
docs/INTERNALS.md -> docs/DEPENDENCIES.md
- docs: Clarify that cookies need domain set to match
- docs: Connection reuse behaviour for socket callbacks
docs: Make 5 example snippets compile cleanly with clang
- docs: Mention possible auth option conflicts
docs: Remove doubled word in SECURITY-ADVISORY.md
- DoH: Improvements
- easy: Fix unused global on non-Windows
easy_lock: Silence 'portability-no-assembler' with clang-tidy 23.1.0+
- FAQ: Correct an option typo
- file: Support directory listing on Windows
- filter: Change time reporting
- FTP: Fix TLS session reuse on the data connection
ftp: Reject control bytes in ACCT and alternative-to-user
- gitignore: Maintenance updates
gopher: Fix partial sends of CRLF
gopher: Reject CR and LF in the selector
- h2 push: Use squeaky clean easy handle
- h2: Bootstrap max streams from multi handle if in use
h3-proxy: Fix NULL deref when non-:status header arrives before :status
- Happy Eyeballing v3: Resolution delay of 25ms
- header api: Add guards
- headers: Name the arguments the way the definitions name them
HISTORY.md: PSL support in 2015
HISTORY: Add when c-ares support was introduced (2004)
HISTORY: September 1999: Started using CVS
hostip: Only cache negative resolves for authoritative answers
- hsts: Only match the exact strings
- http digest: Tie peer/credentials on input
http2: Make server push transfers inherit share from parent (CVE-2026-18924)
- http2: Remove assert in ingress processing
http: Avoid length underflow in Curl_compareheader
http: Custom Authorization: header overrides Negotiate
- http: Fix non-tunneling proxy hostname use
- http: Stop dropping large custom headers
http: Trim custom header name before the Authorization drop
- httpsrr: DoH with HTTPS, fix response handling
idn: Restore 'MultiByteToWideChar()' 'MB_ERR_INVALID_CHARS' flag
imap: APPEND CRLF fix
include: include <sys/select.h> when building for modern Linux
INSTALL.md: Add building-from-source overview section
INTERNALS.md: Require quiche 0.20.0+
ipv6 scope_id: Set from first peer
keylog: Add a random size argument to Curl_tls_keylog_write()
- ldap: base64-encode LDIF values beginning with colon or less-than
- ldap: Reject control characters in URL-decoded filter values
- ldap: Support empty username and password
- ldap: Support insecure mode for Windows native LDAP
lib1587: Fix gcc '-Wconversion' with LibreSSL on Windows, test in CI
lib2405: Adjust for non-threaded builds
lib: Add "Curl_" prefix to two global functions
lib: Add multi_wakeup_internal
lib: Drop unused 'system_win32.h' includes
lib: Fix 'ns' -> 'us' in trace messages
- lib: New easy option string storage
- lib: Optimize struct layouts for reduced memory usage
- lib: Ratelimit timestamps
lib: Silence gcc-16 compiler warnings '-Wmaybe-uninitialized'
- lib: Update mentions of the legacy "sessionhandle"
libcurl.md: Emphasize that the output needs checking
libcurl.pc: Add 'License' tag
libcurl.pc: Add Copyright tag to the pkgconf file
libcurl.pc: Add the Link.ABI and Source tags
- macos sectrust: Fail ocsp verify when not builtin
Makefile.am: Improve etags
mbedtls: Enforce verifyhost when verifypeer is disabled
mbedtls: Replace 'memset()' with 'psa_hash_operation_init()'
md5: Replace magic numbers with 'MD5_DIGEST_LEN'
mime.c: Avoid integer overflow in base64 size calculation
- mime: Reject CR and LF in mail part name and filename
mod_curltest: Fix compiler warnings
mprintf: Acknowledge %F
mprintf: Avoid never-ending loop for positive-infinite
mprintf: Fix long double output
- mqtt: Reject control bytes in the topic
multi: Cap expire times to INT_MAX internally
multi: Forbid curl_easy_pause from within multi socket callback
multi: Hold timeout values in 'int' instead of 'long'
multi: Remove #if 0'ed code that uses old struct
- multi: Shrink expire timer indices
- multi: Timeout improvements
- multi: Use index list for expire timeouts
- multi: Xfer table initial size and growth
- multihandle: Move two struct fields
ngtcp2+openssl: Fix early data
ngtcp2: Avoid NULL deref in cf_ngtcp2_send
ngtcp2: Clean up after ngtcp2 in 'curl_global_cleanup'
ngtcp2: Let verify failures win over expiry processing errors
openldap: Handle Curl_sasl_continue() returns better (CVE-2026-13608)
openssl+sectrust: Fix session reuse
openssl+sectrust: Move session verified set into result check
openssl: Avoid conn reuse if provider is used (CVE-2026-80229)
openssl: Avoid strlen() on the data from OpenSSL
openssl: aws-lc ocsp workaround
openssl: Drop unused pre-OpenSSL3 'ctx_option_t' typedef
openssl: Fix DER buffer leak in Apple SecTrust verification
openssl: No server cert is only okay if also not pinned (CVE-2026-80230)
openssl: Prefer modern API flavours for 'EVP_MD_CTX' new/free
openssl: Replace stray legacy API variant with 'EVP_DigestInit_ex()'
- os400: Port latest header files changes to ILE/RPG interface
os400: Rewrite upper ebcdic wrappers using dynbuf
- progress: Clean up, less memory
protocol: Simpler Curl_getn_scheme runs faster
proxy: CONNECT trailers handling
- psl: Update a comment to understandable English
- pytest: Update two H3 tests for nghttp3 1.18.0+
- quic: Upload improvements
- quiche: Set the max field section size
- rtsp: Refactor method handling and improve error checks
runtests: Allow comments in 'setenv' section, merge sections in test433
runtests: Fix 'mode="warn"' tests passing unconditionally, fix test 1752
runtests: Flush cached test parts when (re)loading a file
runtests: Restore '-k' option and actively process as no-op
- sasl: Fix zero-length response encoding
schannel: Add ALPN support for mingw-w64 <9 and <VS2015
- schannel: Clear PFX password before free
- schannel: Fix ALPN erroneously disabled
schannel: Fix error check logic in 'get_client_cert()' file reader
- schannel: Refresh stream sizes after renegotiation
- schannel: Reuse the send buffer
- schannel: Shut off experimental TLS 1.3 support for Win 10
scorecard: Fix 'max_upload' init value in 'ul_parallel()'
scripts/badwords.txt: Do not recommend using 'will' in rewrites
scripts: Replace/extend '--' with '--end-of-options' in git commands
scripts: Use end-of-options marker in 'cd', 'mkdir', 'mv', 'sha256sum' commands
servers: Fix HANDLE leak in UWP builds
servers: Fix to reverse 'SA_RESTART' option for 'sigaction()' on modern codepath
setopt: Allow setting a referer from CURLINFO_REFERER
setopt: Error for CURLOPT_SHARE when easy handle is used
setopt: Make NULL 'CURLOPT_AWS_SIGV4' disable aws-sigv4 auth
- setopt: Return OK earlier for the deprecated h2 dep options
- share unlink: Forget connection
- smtp: Reject CR and LF in the envelope address
- spacecheck: Cap number of lines per file
spnego_sspi: Drop redundant UNICODE branch
spnego_sspi: Pass channel bindings on initial context
- src: Safely clear certain buffers
sshserver.pl: Bump an sshd config to use its modern name
- ssls: Fix potential memory leak on import
- sspi: Add local helper macro to avoid UNICODE branching
sspi: Enable channel-binding in mingw-w64 <9 builds
strcase: Inline the raw case conversions
- sws: Allow connection-monitor to log all disconnects
- sws: Log the exact closing reason better, to help debugging tests
- terminal: Enhance terminal size detection for multiple outputs
- test 1560: Test RFC4291 style IPv6 IPv4-mapped addresses
test1560: Allow to build and run without LDAP support
test798: Force IPv4 to avoid cross-runner port aliasing
test: Adjust test_06_13 for 0100::/64 being blackholed
tests: Address mutable class vars and naive datetime in Python code
- tests: Change whitespace and comments in Python test code
tests: Convert unit test 1396 and 1398 into libtests
- tests: Enable and fix some new Python ruff warnings
tests: Fix Content-Length mismatch in test 2064
- tests: Fix the FTP check for unexpected RST
- tests: Fix type promotion on 32-bit arches in http test code
- tests: Fix typo in assert message in http test
- tests: Improve exception handling in Python test code
tests: Remove test1701
- tests: Simplify by removing unneeded Python code
- tests: Skip test 311 for wolfSSL 5.9.2
- tests: Target Python 3.8 as the minimum Python version
- tests: Use simpler constructions in Python code
thrdpool: Retry failed thread starts while items wait
thrdqueue: Drop name strdups from Curl_thrdq_create
tidy-up: 'TEXT()' vs. '_TEXT()' vs. '_T()' use (Windows)
- tidy-up: Comments, messages, formatting
- tidy-up: Drop redundant includes
- tidy-up: Fix Perl syntax and formatting nits
- tidy-up: Fix typos in docs and comments
- tidy-up: Formatting, messages and comments
- tidy-up: Minor code fixes and improvements
- tidy-up: Typos, comment nits
timeval: Make 'Curl_freq' variable static (Windows)
tool: checkfds, open on null device
- tool: Do not flush on out-null
- tool: Fix memory use in parallel mode
- tool: Init progress bar on demand
- tool: Remove duplicate setopts
tool_cb_hdr: De-duplicate filename setter
tool_cb_hdr: Do not truncate etags output to stdout
tool_cb_prg: Avoid integer overflows
tool_doswin: Add stdin relay auth
tool_doswin: Don't use 'TerminateThread' in stdin relay
tool_doswin: Fix stdin data truncation
tool_msgs: Make notef() respect --silent
tool_operate: Limit 'is_using_schannel()' call to Windows
tool_operate: Only check for schannel if on windows
tool_operate: Remove call to abort()
tool_paramhlp: --proto only supports one modifier
tool_xattr: Add support for Windows alternate data stream
- transfer: DID handling
typecheck-gcc: Allow passing 'char[]' as callback data
uint-spbset: Reused empty chunks
unit3214: Fix to pass on systems with >=128-bit pointers
- url: Fix handling of empty user in NTLM matching
- url: Fix negotiate/ntlm connection reuse
url: Reject control codes in credentials set via CURLOPT
- urlapi: Allow URLs to not have userauth (hostname)
urlapi: Avoid dedotdotify() if possible
- urlapi: Clear password buffer on error path
- urlapi: Do not keep an internal port string
- urlapi: Improved return codes
- urlapi: Preserve empty markers in relative URLs
- urldata: Clean ups
urldata: Drop four strings from the aptr struct
urldata: Sort the connectdata struct fields by size
VERSIONS.md: Document Rock-solid curl releases
vms: Fix symbol typo and missing closing quotes in 'config_h.com'
vquic: Add Curl_ prefix to some global functions
vquic: Initialize new callback slot for nghttp3 v1.18.0+
vquic: Silence '-Wmissing-field-initializers' for nghttp3/ngtcp2 callback tables
vquic: Use ngtcp2 v1.25.0 new close2 callback
- vssh: Keyfile use clean-ups
vssh: Silence gcc-11 '-Wnull-dereference', dedupe 'CURL_EASY_STR()' calls
vtls: Move 'native_ca_store' ssl_config_data => ssl_primary_config (CVE-2026-80231)
vtls_scache: Use case sensitive path match
VULN-DISCLOSURE-POLICY.md: Issues that should be found by tests are LOW
wcurl: Import v2026.08.30 (CVE-2026-80256)
- websocket: Pause writing and meta data fix
- winsock: Drop redundant version checks at initialization
wolfssl: Do not run Curl_wssl_setup_x509_store() twice (CVE-2026-82208)
- wolfssl: Fix build for wolfssl without bio chain support
- ws: Fix write callback error handling
- ws: Pause/unpause write handling
Updated perl-Cpanel-JSON-XS to 4.44 as per the Fedora version
Friday 4th September 2026
Fedora Project
Updated perl-Test-Simple to 1.302225 in F-45 and Rawhide:
Name the failing check when an IPC abort escapes a capture block in t/Test2/modules/IPC/Driver/Files.t; the bare "die 255" reported only its own line, and the message went to a captured STDERR that was then discarded, so smoke failures carried no diagnostic at all (GH#1091)
Local Packages
Updated perl-Test-Simple to 1.302225 as per the Fedora version
Sunday 6th September 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260905.001 in F-45 and Rawhide:
- Data update for 2026-09-05
Local Packages
New package perl-Params-SomeUtil (1.09)
Updated perl-Data-OptList to 0.115:
Switch from Params::Util to Params::SomeUtil
Friday 11th September 2026
Fedora Project
Imported and built perl-Params-SomeUtil (1.11) for F-43, F-44, F-45, Rawhide, EPEL-8, EPEL-9, EPEL-10.3 and EPEL-10 (Bug #2529191)
Updated perl-Data-OptList to 0.115 in F-45 and Rawhide:
Switch from Params::Util to Params::SomeUtil
Local Packages
Updated perl-Params-SomeUtil to 1.11:
- Updated FSF address
Updated WHY section to document new differences with Params::Util; none of them are functional - three functions were added to a development release
Saturday 12th September 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260910.001 in Rawhide:
- Data update for 2026-09-10
Updated perl-Cpanel-JSON-XS to 4.51 in F-45 and Rawhide:
Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH#250, GH#58); internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures
Encoder performance improvements suggested in GH#237:
Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000)
encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape
Added eg/bench_large.pl with results
Add faster SIMD UTF-8 validation (GH#213, https://github.com/cyb70289/utf8, MIT)
Fix tests for yath (GH#255): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to 'make xtest' when yath is installed
Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH#254)
Local Packages
Updated mgdiff (1.0) to build against motif rather than openmotif from Fedora 46 onwards, and to drop the ix86 build from Fedora 45 onwards since imake is no longer available for that architecture
Rebuilt perl-Compress-Raw-Lzma (2.224) against xz 5.8.4
Updated perl-Cpanel-JSON-XS to 4.51 as per the Fedora version
Updated perl-DBI to 1.653:
Fix test for 32bit-perl (GH#189)
Fix arbitrary module and file loading via dbm_type/dbm_mldbm (CVE-2026-78030)
- More META checking/updates
Tighten symlink outside of f_dir (CVE-2026-15392) check
- CPAN.org does not forward email anymore
Monday 14th September 2026
Local Packages
Rebuilt bluefish (2.4.2), libxslt (1.1.43) and perl-XML-LibXML (2.0213) for libxml-2.15.4 in Rawhide
Updated unrar to 7.30 beta 1
Tuesday 15th September 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260912.001 in Rawhide:
- Data update for 2026-09-12
Updated perl-Cpanel-JSON-XS to 4.52 in F-45 and Rawhide:
- OSX 10.9 fix for SIMD UTF-8
Change maintainer email to reini.urban@gmail.com
Updated perl-Number-Format to 1.78 in Rawhide:
- Added support for terabytes; this feature was intentionally omitted for a long time for support of 32-bit perls
Converted to Dist::Zilla for future maintenance
Updated perl-Sub-Exporter to 0.992 in F-45 and Rawhide:
Replace Params::Util with Params::SomeUtil
- docs: Fix typo in tutorial
Updated perl-Test-Fatal to 0.019 in F-45 and Rawhide:
- Lower required Perl to v5.8
Local Packages
Updated perl-Cpanel-JSON-XS to 4.52 as per the Fedora version
Updated perl-Sub-Exporter to 0.992 as per the Fedora version
Updated perl-Test-Fatal to 0.019 as per the Fedora version
Updated perl-Text-Diff to 1.46:
Removed duplicated code (GH#5)
Thursday 17th September 2026
Fedora Project
Updated perl-Number-Format to 1.79 in Rawhide:
Document that format_bytes inherits the object's format_number settings, including decimal_fill for trailing zeroes (CPAN RT#125400)
Document that format_price follows the locale's monetary sign rules and does not consult NEG_FORMAT (CPAN RT#124862)
Documentation no longer claims that assigning to the exported :vars variables affects the functional interface; that has been broken since v1.60 in 2008 (CPAN RT#73717)
format_number keeps the sign on tiny negative numbers that fall back to scientific notation (CPAN RT#77643)
format_picture no longer warns about an uninitialized value when neg_format has no prefix, like "x" (CPAN RT#148306)
Sunday 20th September 2026
Fedora Project
Updated perl-Devel-CallChecker to 0.010 in F-45 and Rawhide:
Adopt maintenance under PAUSE ID SHINGO
Establish the canonical source repository and issue tracker on GitHub
- Add current-Perl CI and a reproducible direct-downstream compatibility test procedure and baseline matrix for release validation
Local Packages
Updated perl-Devel-CallChecker to 0.010 as per the Fedora version
Monday 21st September 2026
Fedora Project
Updated perl-Devel-CallParser to 0.005 in F-45 and Rawhide:
Restore the pad name list as well as the pad when a keyword is declined on ithreads perls: the first "my" of a block opened right after a declined keyword (if, while, print, any of them) was never closed at the block's end and masked an outer lexical of the same name for the rest of the scope; loading the module broke "my" scoping in everything compiled after it (t/blockscope.t)
Local Packages
Updated perl-DateTime-TimeZone to 2.70:
- This release is based on version 2026d of the Olson database
- Contemporary changes for Canada's Northwest Territories
Tuesday 22nd September 2026
Fedora Project
Updated perl-Unicode-CheckUTF8 (1.03) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Wednesday 23rd September 2026
Fedora Project
Updated perl-MIME-tools to 5.519 in F-45 and Rawhide:
Some (buggy) software creates base64-encoded parts as a concatenation of multiple base64-encoded streams, and some client software decodes each stream separately and concatenates the results; duplicate this behaviour in MIME::tools to prevent it from being used as a mechanism to sneak dangerous content past a security scanner
Updated perl-Taint-Util (0.08), perl-Test-CPAN-Meta (0.25), perl-Test-CPAN-Meta-JSON (0.16), perl-Test-CPAN-Meta-YAML (0.25), perl-Test-Exception (0.43), perl-Test-HasVersion (0.014), perl-Test-Modern (0.013), perl-Test-RequiresInternet (0.05), perl-Test-Signature (1.11), perl-Test-TinyMocker (0.05), perl-Test-XML (0.08) and perl-Test-YAML-Meta (0.22) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Local Packages
Updated curl (rc) to the new upstream release candidate 8.23.0~rc1
Updated perl-MIME-tools to 5.519 as per the Fedora version
Thursday 24th September 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260923.001 in F-45 and Rawhide:
- Data update for 2026-09-23
Updated perl-Params-SomeUtil to 1.12 in F-45 and Rawhide:
Updated perl-Scalar-Properties (1.100860), perl-Set-Scalar (1.29), perl-Software-License-CCpack (1.11), perl-Spreadsheet-WriteExcel (2.40), perl-Sub-Exporter-Progressive (0.001013), perl-Sysadm-Install (0.48) and perl-Sys-Hostname-Long (1.5) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Local Packages
Updated perl-Module-CoreList to 5.20260924:
- Updated for v5.45.3
Updated perl-Params-SomeUtil to 1.12 as per the Fedora version
Friday 25th September 2026
Fedora Project
Updated perl-Package-Anon (0.05), perl-Perl6-Junction (1.60000), perl-Perl6-Slurp (0.051005), perl-Perl-Destruct-Level (0.02), perl-Perl-OSType (1.010), perl-PPI-HTML (1.08) and perl-PPIx-Utilities (1.001000) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Updated perl-Business-ISBN-Data to 20260925.001 in F-45 and Rawhide:
- Data update for 2026-09-24
Local Packages
Updated curl (rc) to new upstream release candidate 8.23.0~rc2
Updated perl-DBI to 1.654:
Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815)
Fix FetchHashKeyName on IV/NV (CVE-2026-88816)
- Fix provides in META
I had to add a patch to fix build with pre-C99 compilers (GH#197)
Monday 28th September 2026
Fedora Project
Updated perl-Cpanel-JSON-XS to 4.53 in F-45 and Rawhide:
Fix C90 violations with arm neon (GH#258)
- Added a native arm64 test runner
Updated perl-Exception-Class to 1.46 in F-45 and Rawhide:
If you use Exception::Class to create a class whose module file is already loaded, it no longer overwrites the %INC entry for that module with the path to Exception/Class.pm; typically, this happens when you have a package that implements an exception with the same name as the package itself (GH#17)
Similarly, if a package defines a $VERSION, this is no longer overwritten when the exception class is defined with Exception::Class (GH#18)
Updated perl-MooseX-Aliases (0.11), perl-MooseX-Types-Stringlike (0.003), perl-MouseX-ConfigFromFile (0.05), perl-MouseX-SimpleConfig (0.11) and perl-MouseX-Types-Path-Class (0.07) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Local Packages
Updated perl-Cpanel-JSON-XS to 4.53 as per the Fedora version
Updated perl-Exception-Class to 1.46 as per the Fedora version
Tuesday 29th September 2026
Fedora Project
Updated perl-Math-Calc-Units (1.07), perl-MLDBM (2.05) and perl-Module-Implementation (0.09) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Wednesday 30th September 2026
Fedora Project
Updated perl-IO-Multiplex (1.16), perl-Jcode (2.07) and perl-Locale-US (3.04) in Rawhide to use the %{make_build} and %{make_install} macros during the build
Local Packages
Updated perl-DBI to 1.655:
Fix for C89 (GH#197)
- Ignore invalid handles consistently
Previous Month: August 2026
Next Month: October 2026