Release presentation

Numbers

the 264th release
8 changes
56 days (total: 9,819)
244 bugfixes (total: 11,417)
367 commits (total: 34,180)
2 new public libcurl function (total: 96)
0 new curl_easy_setopt() option (total: 306)
1 new curl command line option (total: 267)
65 contributors, 34 new (total: 3,332)
34 authors, 18 new (total: 1,341)
3 security fixes (total: 164)

Security

CVE-2025-0167: netrc and default credential leak. When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

CVE-2025-0665: eventfd double close. libcurl would wrongly close the same file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

CVE-2025-0725: gzip integer overflow. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. There should be virtually no users left using such an old and vulnerable zlib version.

Changes

• curl: add byte range support to –variable reading from file
• curl: make –etag-save acknowledge –create-dirs
• curl: add ‘time_queue’ variable to -w
• getinfo: provide info which auth was used for HTTP and proxy:
• openssl: add support to use keys and certificates from PKCS#11 provider
• QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
• vtls: feature ssls-export for SSL session im-/export
• hyper: dropped support

Bugfixes

Some of the bugfixes to highlight.

libcurl

• acknowledge CURLOPT_DNS_SERVERS set to NULL
• fix CURLOPT_CURLU override logic
• initial HTTPS RR resolve support
• ban use of sscanf()
• conncache: count shutdowns against host and max limits
• support use of custom libzstd memory functions
• cap cookie expire times to 400 days
• parse only the exact cookie expire date
• include the shutdown connections in the set curl_multi_fdset returns
• easy_lock: use Sleep(1) for thread yield on old Windows
• ECH: update APIs to those agreed with OpenSSL maintainers
• fix ‘time_appconnect’ for early data with GnuTLS
• HTTP/2 and HTTP7/3: strip TE request header
• mbedtls: fix handling of blocked sends
• mime: explicitly rewind subparts at attachment time.
• fix mprintf integer handling in float precision
• terminate snprintf output on windows
• fix curl_multi_waitfds reporting of fd_count
• fix return code for an already-removed easy handle from multi handle
• add an ssl_scache to the multi handle
• auto-enable OPENSSL_COEXIST for wolfSSL + OpenSSL builds
• use SSL_poll to determine writeability of OpenSSL QUIC streams
• free certificate on error with Secure Transport
• fix redirect handling to a new fragment or query (only)
• return “IDN” feature set for winidn and appleidn

scripts

• numerous cmake improvements
• scripts/mdlinkcheck: markdown link checker

curl tool

• return error if etag options are used with multiple URLs
• accept digits in –form type= strings
• make –etag-compare accept a non-existing file

docs

• add INFRASTRUCTURE.md describing project infra

Next

The next release is probably going to be curl 8.13.0 and if things go well, it ships on April 2, 2025.