From 04f1d0f1b9f50bb8b213da521c77cb129472501f Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 24 Jun 2026 20:40:57 +0200 Subject: [PATCH] package/libcurl: security bump to version 8.21.0 https://curl.se/ch/8.21.0.html https://daniel.haxx.se/blog/2026/06/24/curl-8-21-0/ Fixes the following CVEs: Severity Medium CVE-2026-8925: SASL double-free CVE-2026-8927: env-set cross-proxy Digest auth state leak CVE-2026-9079: stale proxy password leak CVE-2026-11856: cross-origin Digest auth state leak Severity Low CVE-2026-8286: wrong STARTTLS connection reuse CVE-2026-8458: wrong reuse for different services CVE-2026-8924: trailing dot domain super cookie CVE-2026-8926: password leak with netrc and user in URL CVE-2026-8932: incomplete mTLS config matching in conn reuse CVE-2026-9080: UAF after pause in socket callback CVE-2026-9545: exposing HTTP/3 early data CVE-2026-9546: sending old referer CVE-2026-9547: SSH improper host validation CVE-2026-10536: HTTP/2 stream-dependency tree UAF CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop CVE-2026-11564: Native CA trust persist CVE-2026-11586: WS Auto-PONG memory exhaustion CVE-2026-12064: proto-default skips SSH verification Signed-off-by: Bernd Kuhls Signed-off-by: Fiona Klute (cherry picked from commit be2789d08432da951c0ebfb23b034072601bc8fe) Signed-off-by: Thomas Perale --- package/libcurl/libcurl.hash | 6 +++--- package/libcurl/libcurl.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libcurl/libcurl.hash b/package/libcurl/libcurl.hash index 549527b1af..e2393bf2f4 100644 --- a/package/libcurl/libcurl.hash +++ b/package/libcurl/libcurl.hash @@ -1,7 +1,7 @@ -# From https://github.com/curl/curl/releases/tag/curl-8_20_0 +# From https://github.com/curl/curl/releases/tag/curl-8_21_0 # after checking pgp signature: -# https://curl.se/download/curl-8.20.0.tar.xz.asc +# https://curl.se/download/curl-8.21.0.tar.xz.asc # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 -sha256 63fe2dc148ba0ceae89922ef838f7e5c946272c2e78b7c59fab4b79d3ce2b896 curl-8.20.0.tar.xz +sha256 aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6 curl-8.21.0.tar.xz # Locally computed sha256 82f2f4427d6545ee5aaac4f0b80428da6cc8ba41c2cf5da3a03680ec327b9681 COPYING diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index ac233fd939..300ac81bc1 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBCURL_VERSION = 8.20.0 +LIBCURL_VERSION = 8.21.0 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz LIBCURL_SITE = https://curl.se/download LIBCURL_DEPENDENCIES = host-pkgconf \