The connection libcurl should have thrown away
Nine advisories, one Medium, a workaround for anyone stuck on a vendor build, and the deprecation dates that follow this release.
curl 8.22.0 shipped on September 2. Daniel Stenberg's release post counts it as the 276th release, with "6 changes, 70 days (total: 10,887), 302 bugfixes (total: 14,489), 525 commits (total: 39,608)" and "9 security fixes (total: 215)". Ten CVEs were published alongside it: nine for curl and libcurl, one for the wcurl wrapper. Eight of the nine are rated Low. The one rated Medium is the reason to upgrade a shared-user service today rather than at the next maintenance window.
The nine, by number
The project's security page lists the advisories fixed in 8.22.0 with their affected ranges:
| CVE | Title | Severity | Affected | |---|---|---|---| | CVE-2026-19931 | Negotiate ambient user conn reuse | Medium | 7.64.1 to 8.21.0 | | CVE-2026-13608 | OpenLDAP SASL authentication bypass | Low | 7.82.0 to 8.21.0 | | CVE-2026-18924 | HTTP/2 server push UAF | Low | 7.44.0 to 8.21.0 | | CVE-2026-80229 | OpenSSL provider use-after-free | Low | 8.14.0 to 8.21.0 | | CVE-2026-80230 | OpenSSL pinning bypass | Low | 7.45.0 to 8.21.0 | | CVE-2026-80231 | native CA store conn reuse | Low | 7.71.0 to 8.21.0 | | CVE-2026-80255 | secure cookie attribute bypass with tab | Low | 8.13.0 to 8.21.0 | | CVE-2026-82208 | wolfSSL CA-cache hit overrides callback | Low | 8.9.1 to 8.21.0 | | CVE-2026-82209 | domain-scoped PSL domain cookie | Low | 7.46.0 to 8.21.0 |
Three of the nine are connection-reuse bugs: libcurl's pool matching on the wrong key and handing one context's connection to another.
The connection that belonged to someone else
The Medium advisory, CVE-2026-19931, is the clearest case. The advisory reads:
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.
curl security advisory CVE-2026-19931
The consequence is that a later request can travel over a connection that was authenticated as a different user. The advisory says versions 7.64.1 through 8.21.0 are affected, and that versions before 7.64.1 and from 8.22.0 onward are not. Its recommendations, in order, are to upgrade to 8.22.0, to apply the patch to your current version, or to set CURLOPT_FORBID_REUSE for transfers that use blank credentials. The third is the workaround for anyone on a distribution build awaiting a backport.
The cookie bug, CVE-2026-82209, is narrower but worth knowing if you run anything on a public suffix. "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk)." The cookie gets saved with domain scope instead of host-only scope, so sibling hosts under the same suffix can see it. The affected range is 7.46.0 through 8.21.0.
TLS-SRP leaves, NTLM is next on the calendar
The six functional changes are terse in the changelog: "gssapi: add support for Apple GSS Framework", "hardening: add API guards", "RFC 9421 HTTP Message Signatures support", "spnego: block NTLM fallback in SPNEGO negotiation", "TLS: drop support for TLS-SRP", and "vquic: add option to use Apple fast UDP". The release post marks the RFC 9421 support as experimental and notes "4 new curl_easy_setopt() option (total: 312), 4 new curl command line option (total: 278)", without naming them.
The TLS-SRP removal was announced in the deprecation document shipped with 8.21.0: "Transport Layer Security Secure Remote Password is a TLS feature that does not work with TLS 1.3 or QUIC and is virtually unused by curl users and in general. TLS-SRP support gets removed in August 2026." The live deprecation page now files it under past removals as "TLS-SRP (removed in 8.22.0)".
The same page keeps three more removals on the calendar. NTLM: "The NTLM authentication method has weak security and is rarely used these days. It has been deprecated by Microsoft and does not work over HTTP/2 or HTTP/3. NTLM support gets removed in September 2026". SMB: "The SMB protocol has weak security and is rarely used these days. SMB support gets removed in September 2026." Local crypto implementations go in October 2026, and "HTTP/2 Server Push gets removed in March 2027." Note that 8.22.0 itself only blocks the NTLM fallback inside SPNEGO; NTLM as a method is still present in this release, so the September date on the page must refer to a later build.
The release table says "The next release is planned to ship on 2026-10-28."
Primary sources: curl 8.22.0 release post, Changes in 8.22.0, curl security problems table, CVE-2026-19931, CVE-2026-82209, DEPRECATE.md at curl-8_21_0, curl deprecation page, curl release table, read 2026-09-04.