25-Year

Cybersecuritynews •Guru Baran • June 25, 2026

A critical security flaw lurking in curl for over 25 years has been patched, as part of a record-breaking security release that fixed 18 CVEs, the most ever issued in a single curl version. The vulnerability, CVE-2026-8932, was first shipped in curl version 7.7 on March 22, 2001, making it the oldest curl security issue […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Curl Patches 25-Year-Old Vulnerability in Major Security Update Curl has released a significant update fixing 18 vulnerabilities, including a critical flaw that has existed for over 25 years. This vulnerability, identified as CVE-2026-8932, was first introduced in curl version 7.7 on March 22, 2001. The update addresses issues related to authentication bypass, memory safety, and host validation in libcurl. The long-standing bug highlights the importance of regular security audits in widely used open-source software. Users of curl are advised to update their systems to mitigate potential risks associated with these vulnerabilities. This release marks the largest number of CVEs fixed in a single curl version to date. 6 sources 58

Extracted Entities

CVEs (1)

CVE-2026-8932

Tools (1)

Curl