CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2026/06/25 12:15:20
Modified files:
net/curl : Makefile distinfo
Log message:
net/curl: update to 8.21.0
Changes:
* curl: named globs in output filename for upload glob references
* HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
* http2: remove stream dependency tracking
* lib: drop support for CURLAUTH_DIGEST_IE
Includes fixes for
CVE-2026-8286: wrong STARTTLS connection reuse
CVE-2026-8458: wrong reuse for different services
CVE-2026-8924: trailing dot domain super cookie
CVE-2026-8926: password leak with netrc and user in URL
CVE-2026-8927: env-set cross-proxy Digest auth state leak
CVE-2026-8932: incomplete mTLS config matching in conn reuse
CVE-2026-9079: stale proxy password leak
CVE-2026-9080: UAF after pause in socket callback
CVE-2026-9545: exposing HTTP/3 early data
CVE-2026-9546: sending old referer
CVE-2026-10536: HTTP/2 stream-dependency tree UAF
CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop
CVE-2026-11586: WS Auto-PONG memory exhaustion
CVE-2026-11856: cross-origin Digest auth state leak
