https://github.com/curl/curl/pull/18928
config: drop support for Heimdal by bagder · Pull Request #18928 · curl/curl · GitHub
The kerberos5 library Heimdal is one of three GSS libraries curl support. It has a memory leak triggered by the new test in #18917 and the project seems mostly...
drop supportpull request
https://github.com/curl/curl/pull/9328
SFTP: make atime/mtime date overflow return error by bagder · Pull Request #9328 · curl/curl ·...
return errorsftpmakeatimedate
Sponsored https://www.trueamateurs.com/
True Amateurs
Watch true amateur pornstars getting naked and fucking on TrueAmateurs. These sexy homemade porn videos will arouse you with the horniest amateur nymphos.
https://github.com/curl/curl/pull/19033
tftp: error requests for blank filenames by bagder · Pull Request #19033 · curl/curl · GitHub
Reported-by: Joshua Rogers
tftperrorrequestsblankbagder
https://github.com/curl/curl/pull/20312
BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026 by bagder · Pull Request #20312 · curl/curl ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
bug bountymdstopend
https://github.com/curl/curl/pull/18644
vtls_int.h: clarify data_pending by bagder · Pull Request #18644 · curl/curl · GitHub
Suggested-by: Joseph Birr-Pixton
vtlsinthclarifydata
https://github.com/curl/curl/pull/19782
auth: always treat Curl_auth_ntlm_get() returning NULL as OOM by bagder · Pull Request #19782 ·...
curl ntlmauthalwaystreatget
https://github.com/curl/curl/pull/19039
pop3: function could get the ->transfer field wrong by bagder · Pull Request #19039 ·...
could getfunctiongttransfer
https://github.com/curl/curl/pull/19651
tool_msgs: make voutf() use stack instead of heap by bagder · Pull Request #19651 · curl/curl ·...
For printf()ing the message to show.
use stacktoolmsgsmakeinstead
https://github.com/curl/curl/pull/20683
VULN-DISCLOSURE-POLICY.md: back to using hackerone on March 1st, 2026 by bagder · Pull Request...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
disclosure policyvulnmdback
https://github.com/curl/curl/pull/20569
schannel: small simplifications by bagder · Pull Request #20569 · curl/curl · GitHub
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
pull requestschannelsmall
Sponsored https://www.flirt4free.com/
Free Live Sex Cams and Adult Chat | Flirt4Free
https://github.com/curl/curl/pull/18647
openssl: make the asn1_object_dump name null terminated by bagder · Pull Request #18647 ·...
opensslmakeobjectdumpname
https://github.com/curl/curl/pull/19858
formdata: validate callback is non-NULL before use by bagder · Pull Request #19858 · curl/curl ·...
curl_formget() accepts a user-provided callback function but does not validate it is non-NULL before calling it. If a caller passes NULL, the function will...
formdatavalidatecallbacknon
https://github.com/curl/curl/pull/20679
URL-SYNTAX.md: fix port number mistakes for IMAP and LDAP by bagder · Pull Request #20679 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
url syntaxport numbermdfix
https://github.com/curl/curl/pull/20425
noproxy: simplify, don't mix const non-const in strchr() by bagder · Pull Request #20425 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
simplifymixconstnon
https://github.com/curl/curl/pull/18749
cf-ip-happy: mention unix domain path, not port number by bagder · Pull Request #18749 ·...
In the connect error message if a unix domain socket was used. Reported-by: kuchara on github Ref: #18748
unix domainport numbercfip
https://github.com/curl/curl/pull/19667
tool_writeout: bail out proper on OOM by bagder · Pull Request #19667 · curl/curl · GitHub
toolwriteoutbailproperoom
https://github.com/curl/curl/pull/18747
openldap: check ber_sockbuf_add_io() return code by bagder · Pull Request #18747 · curl/curl ·...
The man page says nothing about what the return code means but Howard Chu tells me it is 0 on success, -1 on fail. Help-by: Howard Chu
return codeopenldapcheckberio
https://github.com/curl/curl/pull/18551
CURLOPT_TIMECONDITION.md: works for FILE and FTP as well by bagder · Pull Request #18551 ·...
curloptmdworksfileftp
https://github.com/curl/curl/pull/18988
ldap: avoid null ptr deref on failure by bagder · Pull Request #18988 · curl/curl · GitHub
ldap_get_dn() can return NULL on error Reported-by: Joshua Rogers
avoid nullldapptrdereffailure
Sponsored https://ourdream.ai/
ourdream.ai | Ultimate Adult AI Playground | Unlimited Chat, Pics, Videos, and more.
The ultimate adult AI playground. Create unlimited dream companions and explore your every desire. Stunning pics, HD videos, unlimited roleplay, and much more...
https://github.com/curl/curl/pull/20282
checksrc: warn for leading spaces before the hash by bagder · Pull Request #20282 · curl/curl ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
warnleadingspaceshashbagder
https://github.com/curl/curl/pull/19571
http: avoid two strdup()s and do minor simplifications by bagder · Pull Request #19571 ·...
httpavoidtwostrdupminor
https://github.com/curl/curl/pull/20028
compressed.md: might generate a huge amount of bytes by bagder · Pull Request #20028 · curl/curl...
Make sure this is not a surprise
huge amountcompressedmdmight
https://github.com/curl/curl/pull/19864
cookie: improved allocations by bagder · Pull Request #19864 · curl/curl · GitHub
pull requestcookieimproved
Sponsored https://www.erito.com/
Erito
Checkout the official Spicevids pornsite featuring top rated Asian pornstars in HD XXX videos.
https://github.com/curl/curl/pull/20802
tool_operate: reset the URL --url-query between --next by bagder · Pull Request #20802 · curl/curl...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
tool operateurl queryreset
https://github.com/curl/curl/pull/20206
urldata.h: remove two forward-declared structs not used by bagder · Pull Request #20206 · curl/curl...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
urldatahremovetwoforward
https://github.com/curl/curl/pull/19791
libssh2: consider strdup() failures OOM and return correctly by bagder · Pull Request #19791 ·...
considerstrdupfailuresoom
https://github.com/curl/curl/pull/18793
tool_getparam: warn if provided header looks malformed by bagder · Pull Request #18793 ·...
URL: https://fosstodon.org/@galdor/115298664084113519
tool getparamwarnprovided
Sponsored https://fantasy.ai/
Create, Chat, and Connect with Your Perfect AI Companion - Fantasy.ai
Upgrade your Fantasy with a next-level AI Companion Platform. Create, Chat, and Connect. Your Fantasy, your Way!
https://github.com/curl/curl/pull/18976
krb5_gssapi: fix memory leak on error path by bagder · Pull Request #18976 · curl/curl · GitHub
If a non-compliant amount of bytes is received, the function would return error without free. Reported-by: Joshua Rogers
memory leakgssapifixerrorpath
https://github.com/curl/curl/pull/19591
cookie: return error on OOM by bagder · Pull Request #19591 · curl/curl · GitHub
Follow-up to 3f0629c
return errorpull requestoom
https://github.com/curl/curl/pull/19137
cf-socket: make set_local_ip void, and remove failf() by bagder · Pull Request #19137 · curl/curl...
No callers of this function checked the return code, meaning failures are not lethal == failf is wrong, and it can just as well return void.
cf socketlocal ipmakesetvoid
https://github.com/curl/curl/pull/18525
urldata: FILE is not a list-only protocol by bagder · Pull Request #18525 · curl/curl · GitHub
The struct field thus does not depend on the presence of it
urldatafilelistprotocolbagder
https://github.com/curl/curl/pull/19725
ngtcp2: remove the unused Curl_conn_is_ngtcp2 function by bagder · Pull Request #19725 ·...
unused curlremoveconnfunction
https://github.com/curl/curl/pull/20160
altsvc: accept ma/persist per alternative entry by bagder · Pull Request #20160 · curl/curl ·...
alternative entryacceptper
https://github.com/curl/curl/pull/18790
form.md: drop reference to MANUAL by bagder · Pull Request #18790 · curl/curl · GitHub
md dropformreferencemanual
https://github.com/curl/curl/pull/18628
rustls: typecast variable for safer trace output by bagder · Pull Request #18628 · curl/curl ·...
This is a variadic function call with a mismatched argument type; on platforms where uintptr_t and size_t differ, this invokes undefined behavior. Reported in...
rustlstypecastvariablesafer
https://github.com/curl/curl/pull/19802
curl_gssapi: make sure Curl_gss_log_error() has an initialized buffer by bagder · Pull Request...
Reported-by: Stanislav Fort (Aisle Research)
make surecurlgssapilogerror
https://github.com/curl/curl/pull/19110
wolfssl: fix resource leak in verify_pinned error paths by bagder · Pull Request #19110 ·...
Pointed out by ZeroPath
wolfssl fixresourceleakverify
https://github.com/curl/curl/pull/18855
url: make Curl_init_userdefined return void by bagder · Pull Request #18855 · curl/curl · GitHub
It cannot actually return an error, so the parent function does not need to check for error and have an exit path that cannot be reached. Pointed out by...
urlmakeinitreturnvoid
https://github.com/curl/curl/pull/19779
url: fix return code for OOM in parse_proxy() by bagder · Pull Request #19779 · curl/curl ·...
url fixreturn codeoomparse
https://github.com/curl/curl/pull/19382
tool_ipfs: check return codes better by bagder · Pull Request #19382 · curl/curl · GitHub
return codestoolipfscheckpull
https://github.com/curl/curl/pull/19153
HTTP3: clarify the status for "old" OpenSSL, not current by bagder · Pull Request #19153...
clarifystatusquotoldopenssl
https://github.com/curl/curl/pull/18996
doswin: CloseHandle the thread on shutdown by bagder · Pull Request #18996 · curl/curl · GitHub
As this is in the tool shutdown the impact of it was nothing. Also, move two global variables to local. Follow-up to 9a26633 Reported-by: Joshua Rogers
doswinthreadshutdownbagder
https://github.com/curl/curl/pull/19139
socks: avoid UAF risk in error path by bagder · Pull Request #19139 · curl/curl · GitHub
The code obtained a pointer resp via Curl_bufq_peek(), but called Curl_bufq_skip() before it would access them in the failf() call. The Curl_bufq_skip() call...
socksavoiduafriskerror
https://github.com/curl/curl/pull/19938
mdlinkcheck: only look for markdown links in markdown files by bagder · Pull Request #19938 ·...
lookmarkdownlinksfiles
Sponsored https://adultfriendfinder.com/
AdultFriendFinder – The World’s Largest Dating and Social Discovery Site
Join the Largest Community of Fun-Loving Adults - AdultFriendFinder. Discover the excitement of connecting with millions of like-minded members on...
https://github.com/curl/curl/pull/20385
asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails by bagder · Pull Request #20385 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
curl dnscacheasynaresabortoom
https://github.com/curl/curl/pull/19756
rustls: verify that verifier_builder is not NULL by bagder · Pull Request #19756 · curl/curl ·...
Since this function returns allocated resources there is probably at least a theoretical risk this can return NULL. Pointed out by ZeroPath
rustlsverifyverifierbuilder
https://github.com/curl/curl/pull/19872
docs: use more https:// URLs by bagder · Pull Request #19872 · curl/curl · GitHub
https urlspull requestdocsuse
https://github.com/curl/curl/pull/18654
ws: clarify an error message by bagder · Pull Request #18654 · curl/curl · GitHub
error messagepull requestws
https://github.com/curl/curl/pull/18627
curl_slist_append.md: clarify that a NULL pointer is not acceptable by bagder · Pull Request...
null pointercurlappendmd
https://github.com/curl/curl/pull/20285
curl_easy_nextheader.md: a new transfer invalidates 'prev' by bagder · Pull Request #20285 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
curl easymdnewtransferprev
https://github.com/curl/curl/pull/18580
managen: render better manpage references/links by bagder · Pull Request #18580 · curl/curl ·...
When an option name is used in text, this script no longer outputs the short plus long version in the manpage output. It makes the text much more readable....
managenrenderbettermanpage
https://github.com/curl/curl/pull/19459
wolfssl: avoid NULL dereference in OOM situation by bagder · Pull Request #19459 · curl/curl ·...
Verify that wolfSSL_BIO_meth_new() actually works and handle situations where it returns NULL. Reported-by: Stanislav Fort (Aisle Research)
avoid nullwolfssldereference
https://github.com/curl/curl/pull/19780
http: handle oom error from Curl_input_digest() by bagder · Pull Request #19780 · curl/curl ·...
curl inputhttphandleoomerror
https://github.com/curl/curl/pull/20843
http: only send bearer if auth is allowed by bagder · Pull Request #20843 · curl/curl · GitHub
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
httpsendbearerauthallowed
https://github.com/curl/curl/pull/18642
schannel: assign result before using it by bagder · Pull Request #18642 · curl/curl · GitHub
schannelassignresultusingpull
https://github.com/curl/curl/pull/19440
urlapi: fix mem-leaks in curl_url_get error paths by bagder · Pull Request #19440 · curl/curl ·...
Reported-by: Stanislav Fort (Aisle Research)
curl urlfixmemleaksget
https://github.com/curl/curl/pull/19388
tool_paramhlp: refuse --proto removing all protocols by bagder · Pull Request #19388 · curl/curl...
curl is for transfers so disabling all protocols has to be a mistake. Previously it would allow this to get set and then let libcurl return error instead....
toolrefuseprotoremovingbagder
https://github.com/curl/curl/pull/19781
http: acknowledge OOM errors from Curl_input_ntlm by bagder · Pull Request #19781 · curl/curl ·...
acknowledge oomcurl inputhttp
Sponsored https://www.xotic.ai/explore
Explore AI Girlfriend & AI Characters | Xotic
Find your perfect AI girlfriend or explore thousands of unique AI characters. Filter by anime or realistic styles, gender preferences, and discover immersive...
https://github.com/curl/curl/pull/20579
smb: include arpa/inet.h for NonStop by bagder · Pull Request #20579 · curl/curl · GitHub
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
smbincludearpaineth
Sponsored https://www.xlovecam.com/
Skinny Girls - Xlovecam
Chat with hundreds of English and foreign Sexy WebCam Girls, Discover their Live Cam XXX Show for Free, Without Registration and in HD quality at XloveCam...
https://github.com/curl/curl/pull/20375
config2setopts: acknowledge OOM error from CURLOPT_MIMEPOST by bagder · Pull Request #20375 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
acknowledge oomerrorcurlopt
https://github.com/curl/curl/pull/18862
cf-socket: always check Curl_cf_socket_peek() return code by bagder · Pull Request #18862 ·...
Make it trigger a warning if not.
cf socketalways checkcurlpeek
https://github.com/curl/curl/pull/20262
urldata: change 'keep_post' into three distinct bitfields by bagder · Pull Request #20262 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
three distincturldatachange
https://github.com/curl/curl/pull/20221
tool_operate: remove 'else' for VMS by bagder · Pull Request #20221 · curl/curl · GitHub
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
tool operateremoveelsevmspull
Sponsored https://www.secrets.ai/
Secrets AI - #1 Realistic AI Girlfriend Website for Chatting
Chat 24/7 with realistic AI Girlfriend and enjoy 100+ Fantasies. Secrets AI is the best AI girlfriend website for mutual fun & personal AI companion bonding....
https://github.com/curl/curl/pull/19157
cookie: only count accepted cookies in Curl_cookie_add by bagder · Pull Request #19157 ·...
The counter used to stop accepting cookies after a certain amount has been received in a single response would previously also count some cookies that were not...
cookiecountacceptedcurladd
https://github.com/curl/curl/pull/19088
examples/websocket: fix use of uninitialized rlen by bagder · Pull Request #19088 · curl/curl ·...
Pointed out by ZeroPath
fix useexampleswebsocket
https://github.com/curl/curl/pull/18979
Curl_resolv: fix comment. 'entry' argument is not optional by bagder · Pull Request #18979...
Reported-by: Joshua Rogers
curlresolvfixcommententry
https://github.com/curl/curl/pull/18680
hostip: remove unnecessary leftover INT_MAX check in Curl_dnscache_prune by bagder · Pull Request...
The math already uses timediff_t so no need for the extra logic Ref: #18678
remove unnecessaryhostipint
https://github.com/curl/curl/pull/19069
ftp: replace strstr() in ;type= handling by bagder · Pull Request #19069 · curl/curl · GitHub
Since it needs to be a trailing piece of the path avoiding strstr() is faster and more reliable. Also stopped checking the host name since it cannot actually...
type handlingftpreplacebagder
https://github.com/curl/curl/pull/20209
urldata: switch to uint* types more widely by bagder · Pull Request #20209 · curl/curl · GitHub
urldataswitchtypeswidely
https://github.com/curl/curl/pull/19043
libssh2: avoid risking using an uninitialized local struct field by bagder · Pull Request #19043...
Reported-by: Joshua Rogers
avoid riskingusinglocalstruct
https://github.com/curl/curl/pull/20101
curl_quiche: refuse headers with CR, LF or null bytes by bagder · Pull Request #20101 · curl/curl...
curlquicherefuseheaderscr
https://github.com/curl/curl/pull/20118
tool_getparam: use memdup0() instead of malloc + copy by bagder · Pull Request #20118 · curl/curl...
tool getparamuseinsteadmalloc
https://github.com/curl/curl/pull/19829
SOCKS docs: clarification for unix domain sockets by bagder · Pull Request #19829 · curl/curl ·...
unix domainsocksdocssockets
https://github.com/curl/curl/pull/19774
imap: make sure Curl_pgrsSetDownloadSize() does not overflow by bagder · Pull Request #19774 ·...
Follow-up to c1e3a76. The previous update missed an addition that also can wrap and cause confusion. Fixing this by calling Curl_pgrsSetDownloadSize() after...
make sureimapcurloverflow
https://github.com/curl/curl/pull/20805
content_encoding: return 'identity' if none other exists by bagder · Pull Request #20805 ·...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,...
contentencodingreturnidentity
https://github.com/curl/curl/pull/18737
schannel_verify: use more human friendly error messages by bagder · Pull Request #18737 ·...
human friendlyerror messages
https://github.com/curl/curl/pull/19960
tool_urlglob: support globs as long as config line lengths by bagder · Pull Request #19960 ·...
libcurl supports up to 8MB string inputs, the config file accepts up to 10MB line lengths. It did not make sense to limit the globs to a maximum of one...
config linetoolurlglobsupport
https://github.com/curl/curl/pull/19190
ftp: remove 'newhost' and 'newport' from the ftp_conn struct by bagder · Pull...
They are only needed locally, no need to keep them around.
ftpremovenewport
https://github.com/curl/curl/pull/19439
cshutdn: acknowledge FD_SETSIZE for shutdown descriptors by bagder · Pull Request #19439 ·...
In the logic called for curl_multi_fdset(). File descriptors larger than FD_SETSIZE size are simply ignored, which of course will make things break but at...
acknowledgefdshutdownbagder
https://github.com/curl/curl/pull/18719
socks_sspi: bail out on too long fields by bagder · Pull Request #18719 · curl/curl · GitHub
A probably unnecessary precaution but since the field sizes are 16 bit in the protocol this makes sure to fail if they would ever be larger as that would go...
sockssspibaillongfields