Welcome to another curl release. This time we do a bugfix only release, five weeks since the previous version shipped.

Release Presentation

Numbers

the 263rd release
0 changes
35 days (total: 9,763)
79 bugfixes (total: 11,173)
115 commits (total: 33,811)
0 new public libcurl function (total: 94)
0 new curl_easy_setopt() option (total: 306)
0 new curl command line option (total: 266)
51 contributors, 32 new (total: 3,299)
22 authors, 10 new (total: 1,323)
1 security fixes (total: 161)

Security

CVE-2024-11053: netrc and redirect credential leak. (Severity: Low) When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

Bugfixes

As usual, here follows some bugfixes I figure could be worth highlighting. See the changelog on the curl site for the full list of changes.

curl

• –continue-at is mutually exclusive with –no-clobber
• –continue-at is mutually exclusive with –range
• –continue-at is mutually exclusive with –remove-on-error
• use real time in trace timestamps

scripts

• dmaketgz: use –no-cache when building docker image

libcurl

• duphandle: also init netrc
• hostip: don’t use the resolver for FQDN localhost
• mime: fix reader stall on small read lengths
• mprintf: fix integer overflow checks
• multi: fix callback for CURLMOPT_TIMERFUNCTION not being called again
• netrc: address several netrc parser flaws
• netrc: support large file, longer lines, longer tokens
• socket: handle binding to “host!”

http related

• http_negotiate: allow for a one byte larger channel binding buffer
• digest: produce a shorter cnonce in Digest headers
• cookie: treat cookie name case sensitively
• nghttp2: use custom memory functions

protocols

• libssh: use libssh sftp_aio to upload file
• libssh: when using IPv6 numerical address, add brackets
• OpenSSL: improved error message on expired certificate
• rtsp: check EOS in the RTSP receive and return an error code
• schannel: remove TLS 1.3 ciphersuite-list support
• fixes for wolfSSL OPENSSL_COEXIST