The curl project has announced the release of version 8.23.0 on October 14, 2026, addressing 24 security vulnerabilities in the popular data transfer tool and its associated library, libcurl. These updates are crucial for ensuring the security of the tool, which is utilized in 30 billion installations worldwide.
Major Security Flaws Addressed
The latest update resolves significant issues such as credential leaks, authentication mishaps, and command injection vulnerabilities that could potentially disrupt applications. Notably, support for SMB and SMBS protocols has been removed, necessitating compatibility assessments prior to deployment.
A security firm named AISLE identified 18 of these vulnerabilities, contributing to 75% of the total fixes in this release. Through a detailed audit, AISLE reported 24 CVEs, with six addressed in the previous version 8.22.0, and the remaining 18 in the current release.
Key Vulnerabilities Highlighted
Among the critical flaws is CVE-2026-86414, which allows an HTTP proxy to intercept credentials meant for a destination server. This vulnerability affects versions ranging from 7.10.8 to 8.22.0, exposing sensitive authentication data.
Another vulnerability, CVE-2026-94266, risks leaking passwords via CURLINFO_EFFECTIVE_URL, affecting versions 7.62.0 through 8.22.0. Applications logging returned URLs could inadvertently store credentials, posing a security threat.
Additional Security Concerns
CVE-2026-87864 describes an IMAP command injection flaw involving the misuse of CURLOPT_CRLF during message uploads. This issue, affecting versions 7.30.0 through 8.21.0, has been fixed in version 8.22.0 and is considered low severity.
AISLE’s findings also reveal issues such as stale AWS signing headers, credential exposure across redirects, and HSTS cache handling errors. These vulnerabilities can lead to unauthorized data access, misconfigured connections, and application disruptions.
Administrators are urged to update curl and libcurl to version 8.23.0 to mitigate these vulnerabilities. It is recommended to audit applications that embed libcurl to ensure comprehensive security updates. Additionally, reviewing proxy authentication settings and credential logging practices is advised before deploying updates.
