25-Year-Old Vulnerability Patched in Curl

The open source data transfer tool and library curl has shipped a security update addressing 18 vulnerabilities (four medium and 14 low). The most notable issue is CVE-2026-8932, affecting libcurl applications (not the curl command-line tool) and related to mTLS connection reuse that can enable authentication bypass; it traces back to behavior introduced in version 7.7. Other tracked flaws include CVE-2026-8926 (credential confusion), CVE-2026-8925 (double-free), CVE-2026-9080 and CVE-2026-10536 (use-after-free), and CVE-2026-9547 (improper host validation). Because curl is widely used across servers and devices, unpatched flaws in libcurl can be attractive targets for attackers.