{"id":"CVE-2025-0665","aliases":["ALPINE-CVE-2025-0665","AZL-56692","BELL-CVE-2025-0665","CURL-CVE-2025-0665","DEBIAN-CVE-2025-0665","EUVD-2025-1809","GHSA-cc57-hgv8-p56r","JLSEC-2026-421","MGASA-2025-0123","SUSE-SU-2025:03198-1","SUSE-SU-2025:20239-1","UBUNTU-CVE-2025-0665","openSUSE-SU-2025:14809-1"],"status":"published","title":"eventfd double close","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01331,"percentile":0.71315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1341"],"published":"2025-02-05T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.11.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.12.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.12.0+git20250209.89ed161+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.12.0+git20250209.89ed161+ds-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.13.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.12.0+0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"curl","fixed_in":["8.12.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.1-r0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.1-r0"},{"fixed":"8.12.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0+git20250209.89ed161+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.0+git20250209.89ed161+ds-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.1+0"},{"fixed":"8.13.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.11.1+0"},{"fixed":"8.12.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.6.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1.1"}]}]}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xch328"},{"vendor":"siemens","product":"scalance xcm324"},{"vendor":"siemens","product":"scalance xcm328"},{"vendor":"siemens","product":"scalance xcm332"},{"vendor":"siemens","product":"scalance xrh334 (24 v dc, 8xfo, cc)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://curl.se/docs/CVE-2025-0665.json","tags":["Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2025-0665.html","tags":["Vendor Advisory","web","report"]},{"url":"https://hackerone.com/reports/2954286","tags":["Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/05/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/05/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0007/","tags":["Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0665","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cc57-hgv8-p56r","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-0665","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-0665","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0665.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0665","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0123.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33992","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33893","tags":["report"]},{"url":"https://curl.se/docs/CVE-2025-0167.html","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGAA-2025-0004.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520239-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230093","tags":["report"]},{"url":"https://bugzilla.suse.com/1232528","tags":["report"]},{"url":"https://bugzilla.suse.com/1234068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9681","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-0665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-0665","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-0665","title":"eventfd double close","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T09:16:49.038Z","modified":"2026-10-15T01:01:54.492Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-1809","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T09:16:49Z","modified":"2026-10-15T01:01:54Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-cc57-hgv8-p56r","title":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection...","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T12:33:07Z","modified":"2026-10-15T03:34:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1341"],"updated_at":"2026-11-02T15:13:31.301503Z"}],"nvd":[{"id":"CVE-2025-0665","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T10:15:22.857Z","modified":"2026-10-15T02:17:22.017Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"ALPINE-CVE-2025-0665","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T10:15:22.857Z","modified":"2026-08-27T22:18:02.752887365Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-0665","status":"published","published":"2025-02-07T05:58:21.40857Z","modified":"2026-03-19T08:28:28.432479Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-0665","title":"eventfd double close","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T09:16:49.038Z","modified":"2026-10-28T02:30:59.111405367Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"DEBIAN-CVE-2025-0665","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T10:15:22.857Z","modified":"2026-10-15T09:47:44.287137971Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"JLSEC-2026-421","title":"libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection...","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-18T00:02:00.886430002Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2025-0665","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.","status":"withdrawn","published":"2025-02-05T00:00:00Z","modified":"2025-07-16T07:48:06.769294Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"AZL-56692","title":"CVE-2025-0665 affecting package curl for versions less than 8.11.1-3","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T10:15:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"CURL-CVE-2025-0665","title":"eventfd double close","description":"libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.","status":"published","published":"2025-02-05T08:00:00Z","modified":"2026-10-25T01:05:40.558467197Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"MGASA-2025-0123","title":"Updated curl packages fix security vulnerabilities","description":"When asked to use a .netrc file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances. The fix was included\npreviously as part of MGAA-2025-0004.\n","status":"published","published":"2025-04-03T01:36:32Z","modified":"2026-04-16T04:44:31.498401235Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14809-1","title":"curl-8.12.1-1.1 on GA media","description":"These are all security issues fixed in the curl-8.12.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T02:43:52.305991Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20239-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to 8.12.1:\n\n  * Bugfixes:\n\n    - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'\n    - asyn-thread: fix HTTPS RR crash\n    - asyn-thread: fix the returned bitmask from Curl_resolver_getsock\n    - asyn-thread: survive a c-ares channel set to NULL\n    - cmake: always reference OpenSSL and ZLIB via imported targets\n    - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'\n    - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'\n    - content_encoding: #error on too old zlib\n    - imap: TLS upgrade fix\n    - ldap: drop support for legacy Novell LDAP SDK\n    - libssh2: comparison is always true because rc \u003c= -1\n    - libssh2: raise lowest supported version to 1.2.8\n    - libssh: drop support for libssh older than 0.9.0\n    - openssl-quic: ignore ciphers for h3\n    - pop3: TLS upgrade fix\n    - runtests: fix the disabling of the memory tracking\n    - runtests: quote commands to support paths with spaces\n    - scache: add magic checks\n    - smb: silence '-Warray-bounds' with gcc 13+\n    - smtp: TLS upgrade fix\n    - tool_cfgable: sort struct fields by size, use bitfields for booleans\n    - tool_getparam: add \"TLS required\" flag for each such option\n    - vtls: fix multissl-init\n    - wakeup_write: make sure the eventfd write sends eight bytes\n\nUpdate to 8.12.0:\n\n  * Security fixes:\n\n    - [bsc#1234068, CVE-2024-11053] curl could leak the password used\n      for the first host to the followed-to host under certain circumstances.\n    - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry\n    - [bsc#1236589, CVE-2025-0665] eventfd double close\n\n  * Changes:\n\n    - curl: add byte range support to --variable reading from file\n    - curl: make --etag-save acknowledge --create-dirs\n    - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var\n    - getinfo: provide info which auth was used for HTTP and proxy\n    - hyper: drop support\n    - openssl: add support to use keys and certificates from PKCS#11 provider\n    - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA\n    - vtls: feature ssls-export for SSL session im-/export\n\n  * Bugfixes:\n\n    - altsvc: avoid integer overflow in expire calculation\n    - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL\n    - asyn-ares: fix memory leak\n    - asyn-ares: initial HTTPS resolve support\n    - asyn-thread: use c-ares to resolve HTTPS RR\n    - async-thread: avoid closing eventfd twice\n    - cd2nroff: do not insist on quoted \u003c\u003e within backticks\n    - cd2nroff: support \"none\" as a TLS backend\n    - conncache: count shutdowns against host and max limits\n    - content_encoding: drop support for zlib before 1.2.0.4\n    - content_encoding: namespace GZIP flag constants\n    - content_encoding: put the decomp buffers into the writer structs\n    - content_encoding: support use of custom libzstd memory functions\n    - cookie: cap expire times to 400 days\n    - cookie: parse only the exact expire date\n    - curl: return error if etag options are used with multiple URLs\n    - curl_multi_fdset: include the shutdown connections in the set\n    - curl_sha512_256: rename symbols to the curl namespace\n    - curl_url_set.md: adjust the added-in to 7.62.0\n    - doh: send HTTPS RR requests for all HTTP(S) transfers\n    - easy: allow connect-only handle reuse with easy_perform\n    - easy: make curl_easy_perform() return error if connection still there\n    - easy_lock: use Sleep(1) for thread yield on old Windows\n    - ECH: update APIs to those agreed with OpenSSL maintainers\n    - GnuTLS: fix 'time_appconnect' for early data\n    - HTTP/2: strip TE request header\n    - http2: fix data_pending check\n    - http2: fix value stored to 'result' is never read\n    - http: ignore invalid Retry-After times\n    - http_aws_sigv4: Fix invalid compare function handling zero-length pairs\n    - https-connect: start next immediately on failure\n    - lib: redirect handling by protocol handler\n    - multi: fix curl_multi_waitfds reporting of fd_count\n    - netrc: 'default' with no credentials is not a match\n    - netrc: fix password-only entries\n    - netrc: restore _netrc fallback logic\n    - ngtcp2: fix memory leak on connect failure\n    - openssl: define `HAVE_KEYLOG_CALLBACK` before use\n    - openssl: fix ECH logic\n    - osslq: use SSL_poll to determine writeability of QUIC streams\n    - sectransp: free certificate on error\n    - select: avoid a NULL deref in cwfds_add_sock\n    - src: omit hugehelp and ca-embed from libcurltool\n    - ssl session cache: change cache dimensions\n    - system.h: add 64-bit curl_off_t definitions for NonStop\n    - telnet: handle single-byte input option\n    - TLS: check connection for SSL use, not handler\n    - tool_formparse.c: make curlx_uztoso a static in here\n    - tool_formparse: accept digits in --form type= strings\n    - tool_getparam: ECH param parsing refix\n    - tool_getparam: fail --hostpubsha256 if libssh2 is not used\n    - tool_getparam: fix \"Ignored Return Value\"\n    - tool_getparam: fix memory leak on error in parse_ech\n    - tool_getparam: fix the ECH parser\n    - tool_operate: make --etag-compare always accept a non-existing file\n    - transfer: fix CURLOPT_CURLU override logic\n    - urlapi: fix redirect to a new fragment or query (only)\n    - vquic: make vquic_send_packets not return without setting psent\n    - vtls: fix default SSL backend as a fallback\n    - vtls: only remember the expiry timestamp in session cache\n    - websocket: fix message send corruption\n    - x509asn1: add parse recursion limit\n\nUpdate to 8.11.1:\n\n  * Security fixes:\n\n    - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]\n\n  * Bugfixes:\n\n    - build: fix ECH to always enable HTTPS RR\n    - cookie: treat cookie name case sensitively\n    - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected\n    - curl: use realtime in trace timestamps\n    - digest: produce a shorter cnonce in Digest headers\n    - docs: document default 'User-Agent'\n    - docs: suggest --ssl-reqd instead of --ftp-ssl\n    - duphandle: also init netrc\n    - hostip: don't use the resolver for FQDN localhost\n    - http_negotiate: allow for a one byte larger channel binding buffer\n    - krb5: fix socket/sockindex confusion, MSVC compiler warnings\n    - libssh: use libssh sftp_aio to upload file\n    - libssh: when using IPv6 numerical address, add brackets\n    - mime: fix reader stall on small read lengths\n    - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions\n    - mprintf: fix the integer overflow checks\n    - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...\n    - netrc: address several netrc parser flaws\n    - netrc: support large file, longer lines, longer tokens\n    - nghttp2: use custom memory functions\n    - OpenSSL: improvde error message on expired certificate\n    - openssl: remove three \"Useless Assignments\"\n    - openssl: stop using SSL_CTX_ function prefix for our functions\n    - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS\n    - rtsp: check EOS in the RTSP receive and return an error code\n    - schannel: remove TLS 1.3 ciphersuite-list support\n    - setopt: fix CURLOPT_HTTP_CONTENT_DECODING\n    - setopt: fix missing options for builds without HTTP \u0026 MQTT\n    - socket: handle binding to \"host!\u003cip\u003e\"\n    - socketpair: fix enabling 'USE_EVENTFD'\n    - strtok: use namespaced 'strtok_r' macro instead of redefining it\n\nUpdate to 8.11.0:\n\n  * Security fixes: [bsc#1232528, CVE-2024-9681]\n\n    - curl: HSTS subdomain overwrites parent cache entry\n\n  * Changes:\n\n    - curl: --create-dirs works for --dump-header as well\n    - gtls: Add P12 format support\n    - ipfs: add options to disable\n    - TLS: TLSv1.3 earlydata support for curl\n    - WebSockets: make support official (non-experimental)\n\n  * Bugfixes:\n\n    - build: clarify CA embed is for curl tool, mark default, improve summary\n    - build: show if CA bundle to embed was found\n    - build: tidy up and improve versioned-symbols options\n    - cmake/FindNGTCP2: use library path as hint for finding crypto module\n    - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled\n    - cmake: rename LDAP dependency config variables to match Find modules\n    - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection\n    - cmake: use OpenSSL for LDAP detection only if available\n    - curl: add build options for safe/no CA bundle search (Windows)\n    - curl: detect ECH support dynamically, not at build time\n    - curl_addrinfo: support operating systems with only getaddrinfo(3)\n    - ftp: fix 0-length last write on upload from stdin\n    - gnutls: use session cache for QUIC\n    - hsts: improve subdomain handling\n    - hsts: support \"implied LWS\" properly around max-age\n    - http2: auto reset stream on server eos\n    - json.md: cli-option '--json' is an alias of '--data-binary'\n    - lib: move curl_path.[ch] into vssh/\n    - lib: remove function pointer typecasts for hmac/sha256/md5\n    - libssh.c: handle EGAINS during proto-connect correctly\n    - libssh2: use the filename buffer when getting the homedir\n    - multi.c: warn/assert on stall only without timer\n    - negotiate: conditional check around GSS \u0026 SSL specific code\n    - netrc: cache the netrc file in memory\n    - ngtcp2: do not loop on recv\n    - ngtcp2: set max window size to 10x of initial (128KB)\n    - openssl quic: populate x509 store before handshake\n    - openssl: extend the OpenSSL error messages\n    - openssl: improve retries on shutdown\n    - quic: use send/recvmmsg when available\n    - schannel: fix TLS cert verification by IP SAN\n    - schannel: ignore error on recv beyond close notify\n    - select: use poll() if existing, avoid poll() with no sockets\n    - sendf: add condition to max-filesize check\n    - server/mqttd: fix two memory leaks\n    - setopt: return error for bad input to CURLOPT_RTSP_REQUEST\n    - setopt_cptr: make overflow check only done when needed\n    - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED\n    - tool: support --show-headers AND --remote-header-name\n    - tool_operate: make --skip-existing work for --parallel\n    - url: connection reuse on h3 connections\n    - url: use same credentials on redirect\n    - urlapi: normalize the IPv6 address\n    - version: say quictls in MSH3 builds\n    - vquic: fix compiler warning with gcc + MUSL\n    - vquic: recv_mmsg, use fewer, but larger buffers\n    - vtls: convert Curl_pin_peer_pubkey to use dynbuf\n    - vtls: convert pubkey_pem_to_der to use dynbuf\n\nUpdate to 8.10.1:\n\n  * Bugfixes:\n\n    - autotools: fix `--with-ca-embed` build rule\n    - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync\n    - cmake: fix MSH3 to appear on the feature list\n    - connect: store connection info when really done\n    - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a\n    - http2: when uploading data from stdin, fix eos forwarding\n    - http: make max-filesize check not count ignored bodies\n    - lib: fix AF_INET6 use outside of USE_IPV6\n    - multi: check that the multi handle is valid in curl_multi_assign\n    - QUIC: on connect, keep on trying on draining server\n    - request: correctly reset the eos_sent flag\n    - setopt: remove superfluous use of ternary expressions\n    - singleuse: drop `Curl_memrchr()` for no-HTTP builds\n    - tool_cb_wrt: use \"curl_response\" if no file name in URL\n    - transfer: fix sendrecv() without interim poll\n    - vtls: fix `Curl_ssl_conn_config_match` doc param\n\nUpdate to version 8.10.0:\n\n  * Security fixes:\n\n    - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS\n\n  * Changes:\n\n    - curl: make --rate accept \"number of units\"\n    - curl: make --show-headers the same as --include\n    - curl: support --dump-header % to direct to stderr\n    - curl: support embedding a CA bundle and --dump-ca-embed\n    - curl: support repeated use of the verbose option; -vv etc\n    - curl: use libuv for parallel transfers with --test-event\n    - vtls: stop offering alpn http/1.1 for http2-prior-knowledge\n\n  * Bugfixes:\n\n    - curl: allow 500MB data URL encode strings\n    - curl: warn on unsupported SSL options\n    - Curl_rand_bytes to control env override\n    - curl_sha512_256: fix symbol collisions with nettle library\n    - dist: fix reproducible build from release tarball\n    - http2: fix GOAWAY message sent to server\n    - http2: improve rate limiting of downloads\n    - INSTALL.md: MultiSSL and QUIC are mutually exclusive\n    - lib: add eos flag to send methods\n    - lib: make SSPI global symbols use Curl_ prefix\n    - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name\n    - lib: remove the final strncpy() calls\n    - lib: remove use of RANDOM_FILE\n    - Makefile.mk: fixup enabling libidn2\n    - max-filesize.md: mention zero disables the limit\n    - mime: avoid inifite loop in client reader\n    - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks\n    - openssl quic: fix memory leak\n    - openssl: certinfo errors now fail correctly\n    - openssl: fix the data race when sharing an SSL session between threads\n    - openssl: improve shutdown handling\n    - POP3: fix multi-line responses\n    - pop3: use the protocol handler -\u003ewrite_resp\n    - progress: ratelimit/progress tweaks\n    - rand: only provide weak random when needed\n    - sectransp: fix setting tls version\n    - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values\n    - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL\n    - sigpipe: init the struct so that first apply ignores\n    - smb: convert superflous assign into assert\n    - smtp: add tracing feature\n    - spnego_gssapi: implement TLS channel bindings for openssl\n    - src: delete `curlx_m*printf()` aliases\n    - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)\n    - tool_operhlp: fix \"potentially uninitialized local variable 'pc' used\"\n    - tool_paramhlp: bump maximum post data size in memory to 16GB\n    - transfer: skip EOS read when download done\n    - url: fix connection reuse for HTTP/2 upgrades\n    - urlapi: verify URL *decoded* hostname when set\n    - urldata: introduce `data-\u003emid`, a unique identifier inside a multi\n    - vtls: add SSLSUPP_CIPHER_LIST\n    - vtls: fix static function name collisions between TLS backends\n    - vtls: init ssl peer only once\n    - websocket: introduce blocking sends\n    - ws: flags to opcodes should ignore CURLWS_CONT flag\n    - x509asn1: raise size limit for x509 certification information\n","status":"published","published":"2025-03-13T10:36:20Z","modified":"2026-03-23T04:48:13.246694Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}