Curl 8.22.0 patches ten CVEs in libcurl and wcurl

Curl 8.22.0 is out with fixes for ten separate security vulnerabilities in curl, libcurl, and wcurl, project lead Daniel Stenberg announced. The flaws span authentication, TLS verification, HTTP/2 memory safety, connection reuse, and cookie rules. Anyone shipping or linking libcurl, or using the command-line tools and wcurl wrapper, should treat the upgrade as urgent.

CVE-2026-13608 is an OpenLDAP SASL authentication bypass. CVE-2026-18924 is a use-after-free in HTTP/2 server push handling. CVE-2026-19931 lets Negotiate authentication reuse a connection under the wrong ambient user. CVE-2026-80229 is an OpenSSL provider use-after-free. CVE-2026-80230 is an OpenSSL certificate pinning bypass. CVE-2026-80231 mishandles connection reuse against the native CA store. CVE-2026-80255 lets a tab character bypass the secure cookie attribute. CVE-2026-82208 allows a wolfSSL CA-cache hit to override a verification callback. CVE-2026-82209 mishandles domain-scoped cookies against the public suffix list. CVE-2026-80256 is a wcurl backslash path bypass.

Stenberg pointed operators to the project’s full advisory write-ups for impact and affected configurations. The common theme is silent failure of security boundaries that applications assume libcurl enforces: who is authenticated, which certificate is trusted, whether a connection may be reused, and whether a cookie is restricted to HTTPS or the right domain. Fixed builds close those gaps; unpatched clients and libraries remain exposed until updated.