New curl version removes SMB support and fixes 24 security vulnerabilities

The latest version of curl fixes one severe and twenty-three minor security vulnerabilities and says goodbye to support for the SMB protocol. The open-source library for calling URLs is installed on virtually every connected device worldwide –, so the update affects billions of installations.

“One of the most severe security vulnerabilities in a long time” is what curl founder Daniel Stenberg calls the use-after-free error with CVE ID CVE-2026-92392 (severity: high ); a malicious HTTP/2 server can use it for code execution. However, this requires a user upload, so an attack does not work automatically. Stenberg has processed the necessary side conditions and all details the vulnerability into a detailed article . In it, he names Anthropic as the finder and emphasizes again: “We are not going to rewrite curl,” for example, in a memory-safe language like Rust.

Furthermore, cURL 8.23.0 fixes the following security vulnerabilities with low severity: CVE-2026-107928, CVE-2026-107929, CVE-2026-86409, CVE-2026-86410, CVE-2026-86411, CVE-2026-86412, CVE-2026-86413, CVE-2026-86414, CVE-2026-86415, CVE-2026-87861, CVE-2026-87862, CVE-2026-87863, CVE-2026-87864, CVE-2026-87865, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92388, CVE-2026-92389, CVE-2026-92390, CVE-2026-92391, CVE-2026-94265, and CVE-2026-94266. The project dedicates its advisory to each vulnerability, which is linked on the overview page . Curl traditionally does not assign a CVSS score; it only works with severity levels from “low” to “critical.”

It is expected that the updated version of cURL will soon appear via the regular update processes in all software and hardware that uses the product; those who want to accelerate the process can trigger updates manually. Only in rare cases will users have to replace the curl library and command-line programs by hand.

Users of the free library must say goodbye to support for the SMB protocol, both in its plaintext and TLS variants, SMBS. The reason can also be found in Stenberg’s blog : The NTLM implementation required for SMB support in curl has always been error-prone; moreover, it only supported SMBv1 anyway.

Curl is one of the most widely used libraries on the planet; from smartphones to connected cars to macOS Clickfix malware , the URL library and its associated command-line tool are present on billions of devices. Daniel Stenberg is also a prominent thought leader in the scene; he has often spoken and written in the past the sense and nonsense of AI . In July, his project even paused the acceptance of bug reports, calling it the “ Summer of Bliss ”.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.