CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2026/10/14 16:21:01
Modified files:
net/curl : Makefile distinfo
net/curl/pkg : DESCR
Log message:
net/curl: update to 8.23.0
Includes fixes for
CVE-2026-87863: HSTS response erases persisted entries
CVE-2026-87862: HSTS cache import drops longer-lived child
CVE-2026-87861: cross-origin reuse of a Negotiate connection
CVE-2026-86414: leaking host credentials to HTTP proxy
CVE-2026-86413: Negotiate credentials sent to redirected origin
CVE-2026-86412: server-set cookie erases cookie jar
CVE-2026-92392: HTTP/2 upload Use-After-Free
CVE-2026-92391: curl_mime_free stack overflow by recursion
CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
CVE-2026-92389: TFTP direction confusion
CVE-2026-92388: FTP wildcard write callback mixup
CVE-2026-92387: never-ending loop via server response omission
CVE-2026-92386: server-set cookie aborts cookie jar load
CVE-2026-94265: Authorization: Negotiate sent to foreign origin
CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
CVE-2026-107929: local interface connection reuse mixup
