> IT-Sentinel.com

// Cybersecurity & IT News Aggregator - Real-time Threat Intelligence Feed

NEWS CVE
← messages.back_to_articles

> curl 8.16.0

[SOURCE] daniel.haxx.se [AUTHOR: Daniel Stenberg] [DATE: 10/09/2025 05:49] [LANGUAGE: EN]
Welcome to one of the more feature-packed curl releases we have had in a while. Exactly eight weeks since we shipped 8.15.0. Release presentation Numbers the 270th release17 changes56 days (total: 10,036)260 bugfixes (total: 12,538)453 commits (total: 36,025)2 new public libcurl function (total: 98)0 new curl_easy_setopt() option (total: 308)3 new curl command line option (total: 272)76 contributors, 39 new (total: 3,499)32 authors, 17 new (total: 1,410)2 security fixes (total: 169) Security We publish two severity-low vulnerabilities in sync with this release: CVE-2025-9086 identifies a bug in the cookie path handler that can make curl get confused and override a secure cookie with a non-secure one using the same name. If the planets all happen to align correctly. CVE-2025-10148 points out a mistake in the WebSocket implementation that makes curl not update the frame mask correctly for each new outgoing frame – as it is supposed to. Changes We have a long range of changes this time: curl gets a --follow option curl gets an --out-null option curl gets a --parallel-max-host option to limit concurrent connections per host --retry-delay and --retry-max-time accept decimal seconds curl gets support for --longopt=value curl -w now supports %time{} now libcurl caches negative name resolves ip happy eyeballing: keep attempts running bump minimum mbedtls version required to 3.2.0 add curl_multi_get_offt() for getting multi related information add CURLMOPT_NETWORK_CHANGED to signal network changed to libcurl use the NETRC environment variable (first) if set bump minimum required mingw-w64 to v3.0 (from v1.0) smtp: allow suffix behind a mail address for RFC 3461 make default TLS version be minimum 1.2 drop support for msh3 support CURLOPT_READFUNCTION for WebSocket Bugfixes The official bugfix count surpassed 250 this cycle and we have documented them all in the changelog, including links to most issues or pull-requests where they originated. See the release presentation for a walk-through of some of the perhaps most interesting ones.
[messages.read_original_source] →