[RELEASE] curl 8.23.0

From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 14 Oct 2026 08:01:12 +0200 (CEST)

Hello friends.

I'm happy to announce that we have just released curl 8.23.0. Get it as always
from https://curl.se/

curl and libcurl 8.23.0

  Public curl releases: 276
  Command line options: 278
  curl_easy_setopt() options: 312
  Public functions in libcurl: 100
  Authors: 1547
  Contributors: 3844

This release includes the following changes:

  o lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK [64]
  o SMB: drop support [63]
  o tool_cb_wrt: inject the no-clobber number before the extension [21]
  o tool_cb_wrt: try up to .9999 when no-clobbering [46]

This release includes the following bugfixes:

  o apple-sectrust: check ocsp copy alloc [292]
  o apple: shorten versions in `__builtin_available()` calls [251]
  o apple: sync hash init calls, add comments [217]
  o apple: sync up version guard macro style [263]
  o base64: avoid repeated input loads when encoding [114]
  o base64: optimize decode lookup table and quantum loop [88]
  o build: convert HAS_TIME_T_UNSIGNED to a compile-time check [65]
  o build: drop `HTTP_ONLY` option [23]
  o capsule: reject a capsule that can never be buffered [84]
  o cf-h1-proxy: reset chunk state on new request [146]
  o cf-h1-proxy: stricter status line parsing [145]
  o cf-https-connect: re-arm the timer for the hard eyeballs timeout [222]
  o cf-ngtcp2-cmn: fix possible `-Wdeclaration-after-statement` [296]
  o cf-ngtcp2-proxy: check for stream close on rx win update [159]
  o cf-ngtcp2-proxy: fix rx flow control [174]
  o cf-socket: adjust NO_SYN_RETRANSMISSIONS for older Windows [275]
  o cf-socket: clamp keepalive seconds-to-milliseconds conversions [167]
  o cfilters: fail a send that reports more written than requested [194]
  o clang-tidy: merge nested `if()`s [39]
  o cmake/Find*: drop deprecated compatibility config variables [259]
  o cmake: enable C++ library for GCC in AWS-LC/BoringSSL static builds [232]
  o cmake: link llvm stdc++ lib to AWS-LC/BoringSSL-specific feature detections only [271]
  o config2setopts: always set the security options for SCP/SFTP [67]
  o config2setopts: rename define for maximum cookie header length [248]
  o conncache: avoid evicting connect-only connections [79]
  o conncache: never discard a connection still in use [208]
  o conncache: remove bundle dest [50]
  o connect: do not busy-loop in blocking connect without a timeout [240]
  o connect: keep IP info and connect time when connect fails [195]
  o connectdata: use less curltime [34]
  o cookie: accept and ignore empty property names in Set-Cookie [234]
  o cookie: accept and ignore values for 'secure' and 'httponly' [187]
  o cookie: accept slightly longer lines in cookie jars [105]
  o cookie: cookies for a PSL domain from jar just limits tailmatch [176]
  o cookie: ignore individual cookie errors when loading [6]
  o cpool: do not use admin handle for conn lookup [299]
  o cshutdown: make it smaller [60]
  o cshutdown: use ptrarray instead of llist [156]
  o curl-openssl.m4: sync LibreSSL detection method with rest of forks [218]
  o curl_addrinfo: drop redundant parentheses [41]
  o curl_easy_send/recv: check pointer arg [175]
  o curl_fopen: restore the uid and gid checks [70]
  o curl_formadd.md: mention the strlen() for names as well [29]
  o curl_multi_perform: doc update [148]
  o curl_setup.h: drop compatibility raw C flag `ENABLE_IPV6` [260]
  o CURLINFO_EFFECTIVE_URL.md: mention a short lifetime [116]
  o CURLOPT*ISSUERCERT*: not verified cryptographically [28]
  o CURLOPT_POSTFIELDSIZE.md: improve wording [144]
  o CURLOPT_SHARE.md: remove bad explanation for cookie sharing [7]
  o CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats [87]
  o curlx_fopen: add macro to cast file mode [245]
  o cw-out: avoid O(n^2) work while buffering paused output [74]
  o cw-out: recheck callbacks for each call [134]
  o cw-pause: fix O(N^2) list traversal in cw_pause_flush [137]
  o DEPENDENCIES.md: fix release date for valgrind 3.0.0 to 2005-08-03
  o DEPRECATE.md: reflect SMB removal [252]
  o DEPRECATE: Common Name support in TLS certificates for OpenSSL [172]
  o digest: check peer equality for staleness [24]
  o digest: fix maximum length quoted value parsing [22]
  o digest: parse without storing 'value' in local buffer [20]
  o digest: quote the digest-uri param as well [85]
  o dnscache/conncache tweaks [75]
  o dnscache: check hostname on lookup [209]
  o dnscache: compare full hostnames when lookup keys are truncated [301]
  o docs: add the missing .html to the url-encode book link [3]
  o docs: document and align the blocking situations [163]
  o docs: note CAINFO/SSL_VERIFYPEER/SSL_VERIFYSTATUS effect on LDAP [188]
  o docs: SSL session import/file updates [199]
  o doh: reject undersized HTTPS RDATA [11]
  o dynhds: check size overflows [198]
  o dynhds: grow header array geometrically [73]
  o easy: change event pollset construction [242]
  o easy: duplicating a zero byte memory area needs no malloc [91]
  o easy: make ca_cache_timeout standalone [51]
  o easy: validate buffer pointer in curl_easy_recv and curl_easy_send [152]
  o ECH: rework config, add test cases [220]
  o escape: polish encoding and decoding for speed [37]
  o escape: use hex-pair lookup in curl_easy_escape [77]
  o examples: clean up crawler link parsing resources [119]
  o fnmatch: replace recursive matcher with iterative greedy algorithm [72]
  o formdata: reject a negative content length in curl_formadd [128]
  o ftp: require TLS on the data connection for implicit FTPS [126]
  o ftp: tighten use_ssl check for conn reuse [19]
  o ftp: URL encode file names when wildcarding [61]
  o ftplistparser: no more overwriting set.write_func [100]
  o ftplistparser: when wildcarding, skip files with slashes [125]
  o ftpserver.pl: fix warnings when running test 804 [257]
  o getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds [107]
  o getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds [94]
  o getparam: switch off CONNECT headers when using -J [4]
  o glob: reduce the number of allocations for URLs that don't need globbing. [109]
  o global_init: tidy up, simplify, fix issues [43]
  o gnutls: hardening [230]
  o GnuTLS: remove our own OCSP signature verification [266]
  o gtls: no early return on verify fail [149]
  o h3-proxy: teardown fix [182]
  o happy eyeballs: bound work from many duplicate/failing addresses [80]
  o hash: change key arguments to const [14]
  o hash: vary bucket placement across process runs [108]
  o headers: avoid O(n^2) rescans in curl_easy_nextheader() [81]
  o hsts: cap max-age to two years [47]
  o hsts: on load, only remove exact duplicates [56]
  o HTTP-CONNECT: do not react to 401 responses [31]
  o http2: changes in error handling [53]
  o http2: don't send a CURLE_SEND_ERROR after a valid http2 response [71]
  o http2: fix reset after 1xx response [289]
  o http2: init some callbacks for HTTP/2 push easy handles [191]
  o http2: initialize URL handle for server pushes [104]
  o http2: limit trailers and headers count [211]
  o http2: update a refused stream's error after GOAWAY [102]
  o http2: use stream in userdata [246]
  o http: abide to close-rules when transfer-encoding off [132]
  o http: ignore Proxy-Authenticate unless the response comes from a proxy [120]
  o http: only enable Negotiate/NTLM to allowed origins [99]
  o http: reject empty header names [241]
  o http: reject resumed uploads [16]
  o http_aws_sigv4: fix the s3express service name [273]
  o http_chunks: accept exactly 17 characters chunk-size [170]
  o http_chunks: limit trailers size [212]
  o httpsig-key.md: correct the generating Ed25519 keys commands [97]
  o httpsrr+ech: check target and port [133]
  o if2ip: check interface name case sensitive [158]
  o imap: close the connection on premature done instead of finalizing [197]
  o imap: compare selected mailbox names case-sensitively [57]
  o imap: do size checks using 64-bit math [291]
  o inet_pton: reject a colon that ends an IPv6 address [179]
  o IPFS.md: replace sunset link, allowlist another one to avoid `mdlinkcheck` hang [168]
  o KNOWN_BUGS: drop the curl-config private details entry [290]
  o KNOWN_BUGS: drop the empty error buffer entry, it no longer happens [66]
  o ldap: base64-encode a non-SAFE DN and reject a control-byte type name [55]
  o ldap: tidy up variable scope, merge nested `#if`s [206]
  o lib557: exclude three floating point test cases for VS2013 and earlier [249]
  o lib: connection shutdown, cleanup code [92]
  o lib: make private functions static and remove unused code [83]
  o lib: reject internal handles in the multi/easy public API [103]
  o lib: replace `CURLX_FILE_MODE()` with `mode_t` cast [205]
  o libssh2: match hashed known_hosts entries by host [30]
  o libssh2: skip repeat checkp() for already-absent hashed key types [82]
  o libssh: work with empty priv_key [143]
  o mbedtls: fix ticket handling [52]
  o mbedtls: pass correct length for PEM/DER key blobs [177]
  o mbedtls: resend length check [140]
  o mdlinkcheck: pass `--retry-max-time` to avoid server-controlled long retry times [161]
  o mime: bound Curl_mime_duppart() recursion depth [164]
  o mime: bound Curl_mime_prepare_headers() recursion depth [76]
  o mime: do curl_mime_free() non-recursively [48]
  o mprintf: acknowledge %F [300]
  o mprintf: avoid scanning strings twice for unbounded %s [110]
  o mprintf: make mprintf() and mfprintf() return -1 on error [279]
  o mprintf: stage output and emit it in runs [38]
  o mprintf: use size_t width for the bare Windows %I modifier [178]
  o mqtt: drain queued output before advancing the state machine [118]
  o mqtt: remaininglength check for 32-bit systems [150]
  o mqttd: work around bogus VS2019 32-bit compiler warning [202]
  o mulit_ev: remove socket references on forget [89]
  o multi-event: fix timeout of pending transfers [111]
  o multi: adjust the cleanup order in multi_done [135]
  o multi: is_finished() fix [239]
  o multi: reduce struct size with small cleanups [25]
  o multi: remove redundant completion message list [32]
  o multi: store timeout epoch as whole seconds [36]
  o multi_ntfy: fix handling of more than 128 notifications in a batch [86]
  o multi_ntfy: recheck callback on dispatch [228]
  o multi_ntfy: replace enabled bitset with inline flags [44]
  o multihandle: some easy shrinks [33]
  o netrc: empty quoted values now produce a valid empty string [62]
  o netrc: survive comment-only .netrc file [93]
  o ngtcp2: shrink max sendbuf [13]
  o ngtcp2: use stream in userdata [185]
  o openldap: hand it a dup'd socket, not curl's own
  o openssl/gtls: reject CRLfile with native CA store, matching rustls [27]
  o openssl: fix OpenSSL v4.1 no-deprecated build [190]
  o openssl: hardening [227]
  o openssl: support X509 store caching when CApath is configured [264]
  o openssl: use non-deprecated API for MD5/MD4 [69]
  o os400: document curl_formadd_CCSID multi-chunk peculiarity [5]
  o os400: restore HAVE_FCHMOD [181]
  o os400: use correct free function [189]
  o ossl_verifyhost: remove assumption of null-termination of ASN1_STRING. [26]
  o output-dir.md: expand on its behavior [151]
  o parsedate: find day names, months and time zones faster [68]
  o parsedate: remove the unused leading three letters [106]
  o parsedate: validate NULL date pointer in curl_getdate [213]
  o peer: compare zoneid case sensitive [229]
  o peer: parsing a zoneid as number fix [139]
  o peer: preserve ipv6 props from "connect-to" [155]
  o perf-tests: output two-digital decimals always [96]
  o pingpong: add a max loop counter for Curl_pp_readresp [113]
  o pingpong: guard sendleft against a send reporting more than requested [196]
  o pingpong: schedule server response timeouts for the socket API [221]
  o pytest: adjust threshold in test_20_11_crazy_pings for arm64 [237]
  o pytest: check server status without ssl verify [154]
  o pytest: fixture fixes [193]
  o pytest: set `PerSourcePenalties no` when sshd supports it [169]
  o pytest: silence pytest warnings [261]
  o pytest: start all servers early [214]
  o retry.md: clarify that the server can override retry delay time [184]
  o Revert "setopt: clear the 'custom' CA booleans when set to NULL" [235]
  o rtsp: accept a Content-Length body on methods that expected none [115]
  o rtsp: do not send a learned session id to another origin [10]
  o runtests: add extra room for mininum number of tests in sliced jobs [201]
  o runtests: Added runnernums in order to have O(1) lookup [45]
  o runtests: unset `CURL_MEMDEBUG` for curl requests made to the CI API [258]
  o rustls: break recv loop on empty plain text [298]
  o rustls: consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB [219]
  o schannel: auto_client_cert conn matching [17]
  o schannel: clear borrowed sslContext on close [15]
  o schannel: fix `-Wextra-semi-stmt` with clang and extra debug enabled [267]
  o schannel: fix compiler warning `-Wstrict-aliasing` in ALPN code [243]
  o schannel: fix guard for old MSVC workaround [204]
  o schannel: handle empty tokens during renegotiation [183]
  o schannel: retain close_notify records across send retries [302]
  o sectrust: add guards for rest of Apple OS flavors [250]
  o share link: forget connection [223]
  o socketpair: fix accept loop [210]
  o socketpair: use `pipe2()` on Apple OSes (requires SDK 27) [262]
  o socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH [124]
  o socks: track SOCKS5 authentication per socket, not per connection [171]
  o socksd: count connections per test, widen the method2 sentinel
  o ssl: dedup ssl_fsslctx [35]
  o ssls: validate input arguments in import, export, and unpack [136]
  o strparse: speed up number parsing [129]
  o sws: fix connection-monitor for connections closed before a request [153]
  o telnet: make it work through proxy tunnels [112]
  o test 1605: move from unit to libtest [49]
  o test/servers.pm: restrict h2/3 port reuse [203]
  o test1119, 1167: disable MSYS2 argument conversion [254]
  o test1399: improve reliability [9]
  o test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER` [58]
  o test2007: bump to use SHA256 public key hash (was: MD5) [226]
  o test2007: set `MSYS2_ARG_CONV_EXCL` to avoid flaky failures [216]
  o test2072: enable on Cygwin/MSYS2 [256]
  o test428: skip when running on older MSYS2 versions [276]
  o test: restore the old test 1609 as 3271 [162]
  o testcurl.pl: drop support for building c-ares from embedded source tree [253]
  o tests/http: use _at_classmethod when appropriate [231]
  o tests: add SFTP connection reuse tests [224]
  o tests: clean up Python test code [130]
  o tests: fix typos in a comment [247]
  o tests: require valgrind 3+ (2007-08-03) [282]
  o tftp: verify direction in a few places [101]
  o tool: (re)set SSL verification in --libcurl output [1]
  o tool: add Unicode and long-filename support to `--create-dir` (Windows) [141]
  o tool: buffer headers before remote filename selection [98]
  o tool: handling of "synthetic" errors [233]
  o tool_doswin: recognize superscript numbers as reserved [117]
  o tool_easysrc: reset the handle between --next operations [90]
  o tool_getparam: do not print the value of a redacted argument [127]
  o tool_getparam: restore --socks5-gssapi-service [200]
  o tool_help: guard category[2] access when category is bare "-" [59]
  o tool_ipfs: keep the path percent-encoded when rewriting to the gateway [138]
  o tool_operate: clear the retry flag when the output file fails [122]
  o tool_util: add Unicode support to `tool_execpath()` [142]
  o u8_strset, u32_ptrset: fix boundaries handling [131]
  o uint-bset: skip unused slots when counting
  o uint-table: add remove-max precaution [165]
  o unit1399: check microsecond precision across redirects [225]
  o unit1664: add workaround for VS2019 16.3 - VS2022 17.4 x64 miscompile [272]
  o url: check syntax before applying default-protocol [147]
  o url: CURLOPT_INTERFACE fix connection reuse match [186]
  o url: match connections without force reuse and candidates [95]
  o url: ntlm/negotiate, prohibit connection reuse on follows [18]
  o urlapi: make curl_url_dup() copy the guessed_scheme flag [166]
  o urlapi: normalize legacy numeric IPv4 hosts set via CURLUPART_HOST [180]
  o urlapi: return NULL from curl_url_dup() when given a NULL handle [160]
  o urlapi: run the urlparser perf test faster [54]
  o urldata: remove conn->given [40]
  o urldata: remove ssl_primary_config from easy handle [78]
  o urldata: shrink connectdata negotiate states [207]
  o vdns: announce resolver start before the HTTPS RR query is sent [173]
  o vquic: fix preprocessor check for old Darwin versions [8]
  o vquic: use `CURLX_FILE_MODE()` in `Curl_qlogdir()` [238]
  o vssh: do not busy-loop in blocking state machine without a timeout [121]
  o vtls: fix Curl_cert_hostcheck when the pattern is not a C string [12]
  o vtls_scache: remember lock state locally [297]
  o warnless: dedupe Intel compiler warning suppression pragmas [42]
  o wcurl: import v2026.10.12 [236]
  o websocket: auto PONG with client reader fix [215]
  o websocket: error on EOS with incomplete frame [244]
  o wolfssl: remove BIO destroy callback [157]
  o ws: check pointer args in curl_ws_recv [192]
  o ws: do not auto-pong in raw mode [123]
  o x509: stricter parsing [2]

This release includes the following known bugs:

  See https://curl.se/docs/knownbugs.html

For all changes ever done in curl:

  See https://curl.se/changes.html

Planned upcoming removals include:

  o Common Name support in TLS certificates for OpenSSL
  o HTTP/2 Server Push
  o local crypto implementations
  o NTLM

  See https://curl.se/dev/deprecate.html

This release would not have looked like this without help, code, reports and
advice from friends like these:

   1rhino2 on hackerone, Adam Shirt, Adrien Rey-Jarthon, Alexander Köplinger,
   Andreas Westin, Anthropic, Artem Prilutskiy, aschank on github,
   Aviv Engelberg, Axel Mierczuk, Bobbeh Rhino, bupt-Yy-young on github,
   Charles Muehlberger, Christian Hesse, Christian Ullrich, Dan Fandrich,
   Daniel Lang, Daniel McCarney, Daniel S. Roche, Daniel Stenberg, Daniel Wade,
   dataisland, David Benjamin, David Bures, dependabot[bot],
   Fengxiaoxx on github, Fernando Gallardo, Filippo Tedeschi, Florent Castelli,
   Fredrik Blau, GPT-6.1 Sol, Hasan Flayyih Abdullah, Huang Yiheng,
   Ilias Aberkane, İlyas Serdar Dursun, jared-m-cohen-civ on github, jdymitarai,
   Johannes Schindelin, Jorge Rocamora, Joshua Rogers, JuanCarlosgg on github,
   KayanoLiam on github, Kuroda Kayn, ldm0, Luna Tong, Maksim Hayder,
   Marcel Raad, Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu,
   Mohammed K. Fathy, Muhamad Arga Reksapati, Nicolas Grekas, ns-ylambert,
   Paolo Ganci, Patrick Monnerat, rawsun007, Ray Satiro, Rémi NICOLE,
   Renan Pimentel, renovate[bot], Rhino, Richard Payne, Ron Kuper,
   Roshan Ramani, Rudolf Polzer, Samuel Henrique, Sebastian Raase, Skye Soss,
   Stanislav Fort, Stefan Eissing, Stephen Psaradellis, szedenik-adam on github,
   tawmoto on github, Thanniru Sai Teja, Tip ten Brink, Tyler Yankee, Un1q32,
   Viktor Szakats, Wonyoung Jung, xhon-pelushi, Yechan Bae, yuwk
   (84 contributors)

References to bug reports and discussions on issues:

  [1] = https://curl.se/bug/?i=22701
  [2] = https://curl.se/bug/?i=22799
  [3] = https://curl.se/bug/?i=22811
  [4] = https://curl.se/bug/?i=22838
  [5] = https://curl.se/bug/?i=22887
  [6] = https://curl.se/bug/?i=22840
  [7] = https://curl.se/bug/?i=22788
  [8] = https://curl.se/bug/?i=22797
  [9] = https://curl.se/bug/?i=22798
  [10] = https://curl.se/bug/?i=22920
  [11] = https://curl.se/bug/?i=22791
  [12] = https://curl.se/bug/?i=22795
  [13] = https://curl.se/bug/?i=22786
  [14] = https://curl.se/bug/?i=22886
  [15] = https://curl.se/bug/?i=22720
  [16] = https://curl.se/bug/?i=22703
  [17] = https://curl.se/bug/?i=22827
  [18] = https://curl.se/bug/?i=22884
  [19] = https://curl.se/bug/?i=22823
  [20] = https://curl.se/bug/?i=22831
  [21] = https://curl.se/bug/?i=22787
  [22] = https://curl.se/bug/?i=22830
  [23] = https://curl.se/bug/?i=22740
  [24] = https://curl.se/bug/?i=22828
  [25] = https://curl.se/bug/?i=22807
  [26] = https://curl.se/bug/?i=22822
  [27] = https://curl.se/bug/?i=22826
  [28] = https://curl.se/bug/?i=22825
  [29] = https://curl.se/bug/?i=22926
  [30] = https://curl.se/bug/?i=22874
  [31] = https://curl.se/bug/?i=22817
  [32] = https://curl.se/bug/?i=22805
  [33] = https://curl.se/bug/?i=22801
  [34] = https://curl.se/bug/?i=22815
  [35] = https://curl.se/bug/?i=22876
  [36] = https://curl.se/bug/?i=22806
  [37] = https://curl.se/bug/?i=22780
  [38] = https://curl.se/bug/?i=22766
  [39] = https://curl.se/bug/?i=22793
  [40] = https://curl.se/bug/?i=22875
  [41] = https://curl.se/bug/?i=22810
  [42] = https://curl.se/bug/?i=22796
  [43] = https://curl.se/bug/?i=22746
  [44] = https://curl.se/bug/?i=22804
  [45] = https://curl.se/bug/?i=22753
  [46] = https://curl.se/bug/?i=22784
  [47] = https://curl.se/bug/?i=22878
  [48] = https://curl.se/bug/?i=22927
  [49] = https://curl.se/bug/?i=22928
  [50] = https://curl.se/bug/?i=22873
  [51] = https://curl.se/bug/?i=22877
  [52] = https://curl.se/bug/?i=22871
  [53] = https://curl.se/bug/?i=22870
  [54] = https://curl.se/bug/?i=22924
  [55] = https://curl.se/bug/?i=22945
  [56] = https://curl.se/bug/?i=22869
  [57] = https://curl.se/bug/?i=22868
  [58] = https://curl.se/bug/?i=22866
  [59] = https://curl.se/bug/?i=22957
  [60] = https://curl.se/bug/?i=22862
  [61] = https://curl.se/bug/?i=22860
  [62] = https://issues.oss-fuzz.com/issues/560352522
  [63] = https://curl.se/bug/?i=22652
  [64] = https://curl.se/bug/?i=22819
  [65] = https://curl.se/bug/?i=22849
  [66] = https://curl.se/bug/?i=544
  [67] = https://curl.se/bug/?i=22839
  [68] = https://curl.se/bug/?i=22981
  [69] = https://curl.se/bug/?i=22221
  [70] = https://curl.se/bug/?i=22843
  [71] = https://curl.se/bug/?i=22984
  [72] = https://curl.se/bug/?i=22911
  [73] = https://curl.se/bug/?i=22910
  [74] = https://curl.se/bug/?i=22896
  [75] = https://curl.se/bug/?i=22900
  [76] = https://curl.se/bug/?i=22971
  [77] = https://curl.se/bug/?i=23021
  [78] = https://curl.se/bug/?i=22901
  [79] = https://curl.se/bug/?i=22902
  [80] = https://curl.se/bug/?i=22897
  [81] = https://curl.se/bug/?i=22898
  [82] = https://curl.se/bug/?i=22905
  [83] = https://curl.se/bug/?i=22906
  [84] = https://curl.se/bug/?i=22998
  [85] = https://curl.se/bug/?i=23018
  [86] = https://curl.se/bug/?i=22963
  [87] = https://curl.se/bug/?i=22899
  [88] = https://curl.se/bug/?i=22903
  [89] = https://curl.se/bug/?i=22895
  [90] = https://curl.se/bug/?i=22890
  [91] = https://curl.se/bug/?i=22893
  [92] = https://curl.se/bug/?i=22888
  [93] = https://curl.se/bug/?i=22889
  [94] = https://curl.se/bug/?i=23020
  [95] = https://curl.se/bug/?i=22857
  [96] = https://curl.se/bug/?i=22982
  [97] = https://curl.se/bug/?i=22961
  [98] = https://curl.se/bug/?i=22977
  [99] = https://curl.se/bug/?i=23012
  [100] = https://curl.se/bug/?i=22969
  [101] = https://curl.se/bug/?i=22974
  [102] = https://curl.se/bug/?i=22923
  [103] = https://curl.se/bug/?i=22917
  [104] = https://curl.se/bug/?i=22970
  [105] = https://curl.se/bug/?i=22964
  [106] = https://curl.se/bug/?i=23013
  [107] = https://curl.se/bug/?i=23016
  [108] = https://curl.se/bug/?i=22916
  [109] = https://curl.se/bug/?i=22947
  [110] = https://curl.se/bug/?i=23019
  [111] = https://curl.se/bug/?i=22942
  [112] = https://curl.se/bug/?i=22941
  [113] = https://curl.se/bug/?i=22932
  [114] = https://curl.se/bug/?i=23017
  [115] = https://curl.se/bug/?i=12414
  [116] = https://curl.se/bug/?i=23015
  [117] = https://curl.se/bug/?i=23011
  [118] = https://issues.oss-fuzz.com/issues/563679840, https://issues.oss-fuzz.com/issues/559825608
  [119] = https://curl.se/bug/?i=23008
  [120] = https://curl.se/bug/?i=23002
  [121] = https://curl.se/bug/?i=23005
  [122] = https://curl.se/bug/?i=23001
  [123] = https://curl.se/bug/?i=23040
  [124] = https://curl.se/bug/?i=23003
  [125] = https://curl.se/bug/?i=23089
  [126] = https://curl.se/bug/?i=22995
  [127] = https://curl.se/bug/?i=22997
  [128] = https://curl.se/bug/?i=22996
  [129] = https://curl.se/bug/?i=22993
  [130] = https://curl.se/bug/?i=23290
  [131] = https://curl.se/bug/?i=22991
  [132] = https://curl.se/bug/?i=22950
  [133] = https://curl.se/bug/?i=23086
  [134] = https://curl.se/bug/?i=23085
  [135] = https://curl.se/bug/?i=23370
  [136] = https://curl.se/bug/?i=23062
  [137] = https://curl.se/bug/?i=22968
  [138] = https://curl.se/bug/?i=22944
  [139] = https://curl.se/bug/?i=23060
  [140] = https://curl.se/bug/?i=23083
  [141] = https://curl.se/bug/?i=23289
  [142] = https://curl.se/bug/?i=23287
  [143] = https://curl.se/bug/?i=23080
  [144] = https://curl.se/bug/?i=23078
  [145] = https://curl.se/bug/?i=23068
  [146] = https://curl.se/bug/?i=23069
  [147] = https://curl.se/bug/?i=23273
  [148] = https://curl.se/bug/?i=23283
  [149] = https://curl.se/bug/?i=23061
  [150] = https://curl.se/bug/?i=23071
  [151] = https://curl.se/bug/?i=23067
  [152] = https://curl.se/bug/?i=23063
  [153] = https://curl.se/bug/?i=23072
  [154] = https://curl.se/bug/?i=23064
  [155] = https://curl.se/bug/?i=23055
  [156] = https://curl.se/bug/?i=23234
  [157] = https://curl.se/bug/?i=23058
  [158] = https://curl.se/bug/?i=23056
  [159] = https://curl.se/bug/?i=23054
  [160] = https://curl.se/bug/?i=23051
  [161] = https://curl.se/bug/?i=23245
  [162] = https://curl.se/bug/?i=23052
  [163] = https://curl.se/bug/?i=23006
  [164] = https://curl.se/bug/?i=23023
  [165] = https://curl.se/bug/?i=23034
  [166] = https://curl.se/bug/?i=23043
  [167] = https://curl.se/bug/?i=23045
  [168] = https://curl.se/bug/?i=23245
  [169] = https://curl.se/bug/?i=23259
  [170] = https://curl.se/bug/?i=23334
  [171] = https://curl.se/bug/?i=23014
  [172] = https://curl.se/bug/?i=23280
  [173] = https://curl.se/bug/?i=23037
  [174] = https://curl.se/bug/?i=23038
  [175] = https://curl.se/bug/?i=23035
  [176] = https://curl.se/bug/?i=23261
  [177] = https://curl.se/bug/?i=23274
  [178] = https://curl.se/bug/?i=23030
  [179] = https://curl.se/bug/?i=23028
  [180] = https://curl.se/bug/?i=23027
  [181] = https://curl.se/bug/?i=23026
  [182] = https://curl.se/bug/?i=23327
  [183] = https://github.com/git-for-windows/git/issues/6457
  [184] = https://curl.se/bug/?i=23249
  [185] = https://curl.se/bug/?i=23267
  [186] = https://curl.se/bug/?i=23326
  [187] = https://curl.se/bug/?i=23265
  [188] = https://curl.se/bug/?i=23303
  [189] = https://curl.se/bug/?i=23216
  [190] = https://curl.se/bug/?i=23215
  [191] = https://curl.se/bug/?i=23183
  [192] = https://curl.se/bug/?i=23050
  [193] = https://curl.se/bug/?i=23313
  [194] = https://curl.se/bug/?i=23324
  [195] = https://curl.se/bug/?i=23318
  [196] = https://curl.se/bug/?i=23323
  [197] = https://curl.se/bug/?i=23322
  [198] = https://curl.se/bug/?i=23210
  [199] = https://curl.se/bug/?i=23220
  [200] = https://curl.se/bug/?i=23344
  [201] = https://curl.se/bug/?i=23211
  [202] = https://curl.se/bug/?i=23317
  [203] = https://curl.se/bug/?i=23208
  [204] = https://curl.se/bug/?i=23315
  [205] = https://curl.se/bug/?i=23181
  [206] = https://curl.se/bug/?i=23314
  [207] = https://curl.se/bug/?i=23192
  [208] = https://curl.se/bug/?i=23189
  [209] = https://curl.se/bug/?i=23169
  [210] = https://curl.se/bug/?i=23166
  [211] = https://curl.se/bug/?i=23165
  [212] = https://curl.se/bug/?i=23162
  [213] = https://curl.se/bug/?i=23156
  [214] = https://curl.se/bug/?i=23310
  [215] = https://curl.se/bug/?i=23296
  [216] = https://curl.se/bug/?i=23146
  [217] = https://curl.se/bug/?i=23199
  [218] = https://curl.se/bug/?i=23197
  [219] = https://curl.se/bug/?i=23196
  [220] = https://curl.se/bug/?i=23136
  [221] = https://curl.se/bug/?i=23025
  [222] = https://curl.se/bug/?i=23238
  [223] = https://hackerone.com/reports/3971585
  [224] = https://curl.se/bug/?i=23254
  [225] = https://curl.se/bug/?i=23258
  [226] = https://curl.se/bug/?i=23184
  [227] = https://curl.se/bug/?i=23299
  [228] = https://curl.se/bug/?i=23167
  [229] = https://curl.se/bug/?i=23164
  [230] = https://curl.se/bug/?i=23297
  [231] = https://curl.se/bug/?i=23148
  [232] = https://curl.se/bug/?i=23179
  [233] = https://curl.se/bug/?i=23300
  [234] = https://curl.se/bug/?i=23302
  [235] = https://curl.se/bug/?i=22614
  [236] = https://curl.se/bug/?i=23382
  [237] = https://curl.se/bug/?i=23298
  [238] = https://curl.se/bug/?i=23171
  [239] = https://curl.se/bug/?i=23295
  [240] = https://curl.se/bug/?i=23024
  [241] = https://curl.se/bug/?i=23292
  [242] = https://curl.se/bug/?i=23212
  [243] = https://curl.se/bug/?i=23163
  [244] = https://curl.se/bug/?i=23188
  [245] = https://curl.se/bug/?i=23157
  [246] = https://curl.se/bug/?i=23262
  [247] = https://curl.se/bug/?i=23153
  [248] = https://curl.se/bug/?i=23288
  [249] = https://curl.se/bug/?i=23377
  [250] = https://curl.se/bug/?i=23149
  [251] = https://curl.se/bug/?i=23150
  [252] = https://curl.se/bug/?i=23147
  [253] = https://curl.se/bug/?i=23374
  [254] = https://curl.se/bug/?i=23339
  [256] = https://curl.se/bug/?i=23142
  [257] = https://curl.se/bug/?i=23140
  [258] = https://curl.se/bug/?i=23306
  [259] = https://curl.se/bug/?i=23139
  [260] = https://curl.se/bug/?i=23138
  [261] = https://curl.se/bug/?i=23135
  [262] = https://curl.se/bug/?i=23126
  [263] = https://curl.se/bug/?i=23133
  [264] = https://curl.se/bug/?i=23363
  [266] = https://curl.se/bug/?i=23312
  [267] = https://curl.se/bug/?i=23129
  [271] = https://curl.se/bug/?i=23122
  [272] = https://curl.se/bug/?i=23306
  [273] = https://curl.se/bug/?i=23120
  [275] = https://curl.se/bug/?i=23084
  [276] = https://curl.se/bug/?i=23345
  [279] = https://curl.se/bug/?i=23112
  [282] = https://curl.se/bug/?i=23111
  [289] = https://curl.se/bug/?i=23104
  [290] = https://curl.se/bug/?i=23102
  [291] = https://curl.se/bug/?i=23100
  [292] = https://curl.se/bug/?i=23099
  [296] = https://curl.se/bug/?i=23094
  [297] = https://curl.se/bug/?i=23091
  [298] = https://curl.se/bug/?i=23092
  [299] = https://curl.se/bug/?i=23090
  [300] = https://curl.se/bug/?i=22719
  [301] = https://curl.se/bug/?i=23350
  [302] = https://curl.se/bug/?i=23368

-- 
  / daniel.haxx.se || https://rock-solid.curl.dev

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html

Received on 2026-10-14