Name: curl
Version: 8.21.0
Release: 4
Summary: Curl is used in command lines or scripts to transfer data
License: curl
URL: https://curl.se/
Source: https://curl.se/download/curl-%{version}.tar.xz
Patch0001: 0101-curl-7.32.0-multilib.patch
Patch0002: backport-smtp-reject-cr-lf.patch
Patch0003: backport-CVE-2026-9080-post1.patch
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel libzstd-devel
BuildRequires: libssh-devel make openldap-devel openssh-clients openssh-server
BuildRequires: openssl-devel perl-interpreter pkgconfig python3-devel sed
BuildRequires: zlib-devel gnutls-utils nghttp2 perl(IO::Compress::Gzip)
BuildRequires: perl(Getopt::Long) perl(Pod::Usage) perl(strict) perl(warnings)
BuildRequires: perl(Cwd) perl(Digest::MD5) perl(Exporter) perl(File::Basename)
BuildRequires: perl(File::Copy) perl(File::Spec) perl(IPC::Open2) perl(MIME::Base64)
BuildRequires: perl(Time::Local) perl(Time::HiRes) perl(vars) perl(Digest::SHA)
%ifnarch aarch64
BuildRequires: stunnel
%endif
Requires: libcurl = %{version}-%{release}
Provides: curl-full = %{version}-%{release} webclient
%description
cURL is a computer software project providing a library (libcurl) and
command-line tool (curl) for transferring data using various protocols.
%package -n libcurl
Summary: A library for getting files from web servers
Requires: libssh%{?_isa} >= %{installed_version_of libssh}
Requires: libpsl%{?_isa} >= %{installed_version_of libpsl}
Requires: openssl-libs%{?_isa} >= %{installed_version_of openssl-libs}
Requires: libnghttp2%{?_isa} >= %{installed_version_of libnghttp2}
Provides: libcurl-full = %{version}-%{release}
Conflicts: curl < 7.66.0-3
%description -n libcurl
A library for getting files from web servers.
%package -n libcurl-devel
Summary: Header files for libcurl
Requires: libcurl = %{version}-%{release}
Provides: curl-devel = %{version}-%{release}
Obsoletes: curl-devel < %{version}-%{release}
%description -n libcurl-devel
Header files for libcurl.
%package_help
%prep
%autosetup -n %{name}-%{version} -p1
printf "1801\n1701\n" >> tests/data/DISABLED
# adapt test 323 for updated OpenSSL
sed -e 's/^35$/35,52/' -i tests/data/test323
# use localhost6 instead of ip6-localhost in the curl test-suite
(
# avoid glob expansion in the trace output of `bash -x`
{ set +x; } 2>/dev/null
cmd="sed -e 's|ip6-localhost|localhost6|' -i tests/data/test[0-9]*"
printf "+ %s\n" "$cmd" >&2
eval "$cmd"
)
%build
# regenerate Makefile.in files
aclocal -I m4
automake
%configure \
--disable-static \
--enable-hsts \
--enable-ipv6 \
--enable-symbol-hiding \
--enable-threaded-resolver \
--with-zstd \
--with-gssapi \
--with-libidn2 \
--with-nghttp2 \
--with-ssl \
--with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt \
--enable-dict \
--enable-gopher \
--enable-imap \
--enable-ldap \
--enable-ldaps \
--enable-manual \
--enable-mqtt \
--enable-ntlm \
--enable-pop3 \
--enable-rtsp \
--enable-smb \
--enable-smtp \
--enable-telnet \
--enable-tftp \
--enable-tls-srp \
--with-brotli \
--with-libpsl \
--with-libssh \
--with-zsh-functions-dir=%{zsh_completions_dir}
%{?disable_rpath}
%make_build
%check
# compile upstream test-cases
%make_build -C tests
# relax crypto policy for the test-suite to make it pass again (#1610888)
export OPENSSL_SYSTEM_CIPHERS_OVERRIDE=XXX
export OPENSSL_CONF=
# prevent valgrind from being extremely slow (#1662656)
unset DEBUGINFOD_URLS
# we have to override LD_LIBRARY_PATH because we eliminated rpath
export LD_LIBRARY_PATH="${PWD}/lib/.libs"
pushd tests
perl -I../tests ../tests/runtests.pl -a -n -p -v '!flaky' -j16
popd
%install
# curl file install
%make_install
%delete_la
# install zsh completion for curl
LD_LIBRARY_PATH="$RPM_BUILD_ROOT%{_libdir}:$LD_LIBRARY_PATH" %make_install -C scripts
# do not install /usr/share/fish/completions/curl.fish which is also installed
# by fish-3.0.2-1.module_f31+3716+57207597 and would trigger a conflict
rm -rf ${RPM_BUILD_ROOT}%{_datadir}/fish
%files
%license COPYING
%{_bindir}/curl
%{_bindir}/wcurl
%{zsh_completions_dir}/*
%files -n libcurl
%{_libdir}/libcurl.so.4
%{_libdir}/libcurl.so.4.*
%files -n libcurl-devel
%doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md
%doc docs/CONTRIBUTE.md docs/libcurl/ABI.md
%{_bindir}/curl-config*
%{_includedir}/curl
%{_libdir}/*.so
%{_libdir}/pkgconfig/*.pc
%{_datadir}/aclocal/libcurl.m4
%files help
%doc CHANGES.md README*
%doc docs/BUGS.md docs/FAQ.md docs/FEATURES.md
%doc docs/TheArtOfHttpScripting.md docs/TODO.md
%{_mandir}/man?/*
%changelog
* Tue Jul 21 2026 zhouyihang <zhouyihang_z@163.com> - 8.21.0-4
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:post fix for CVE-2026-9080
* Tue Jul 07 2026 zhouyihang <zhouyihang_z@163.com> - 8.21.0-3
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:disable test1701 which conflict with nghttp2 CVE-2026-58055
* Tue Jun 30 2026 Deyuan Fan <fandeyuan@kylinos.cn> - 8.21.0-2
- backport: reject CR and LF in SMTP envelope address
* Fri Jun 26 2026 zhouyihang <zhouyihang_z@163.com> - 8.21.0-1
- Type:requirement
- CVE:NA
- SUG:NA
- DESC:update curl to 8.21.0
* Tue May 05 2026 Funda Wang <fundawang@yeah.net> - 8.20.0-1
- update to 8.20.0
* Mon Mar 16 2026 zhouyihang <zhouyihang_z@163.com> - 8.4.0-28
- Type:CVE
- CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
- SUG:NA
- DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
* Tue Jan 27 2026 zhouyihang <zhouyihang_z@163.com> - 8.4.0-27
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:formdata: validate callback is non-NULL before use
tftp: correct the filename length check
* Wed Jan 14 2026 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
- Type:CVE
- CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
- SUG:NA
- DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
* Wed Dec 24 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:urlapi: avoid null deref if setting blank host to url
urlapi: skip appending NULL pointer query
* Mon Nov 24 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:libssh: fix readdir issues
h3: fix query of concurrent streams
noproxy: fix the IPV6 network mask pattern match
krb5_gssapi: fix memory leak on error path
openldap: fix memory-leak in error path
conn: fix hostname move on connection reuse
pop3: fix CAPA response termination detection
libssh: properly free sftp_attributes
openssl: fix a potential memory leak of params.cert
* Fri Nov 14 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-23
- Type:CVE
- CVE:CVE-2025-10966
- SUG:NA
- DESC:fix CVE-2025-10966
* Fri Sep 12 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-22
- Type:CVE
- CVE:CVE-2025-9086 CVE-2025-10148
- SUG:NA
- DESC:fix CVE-2025-9086 CVE-2025-10148
* Mon Aug 18 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-21
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:tool_getparam: clear argument only when needed
* Mon Aug 04 2025 xingwei <xingwei14@h-partners.com> - 8.4.0-20
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:set ac_cv_func_fork to pass enable ntlm-wb check
* Mon Jul 28 2025 xinghe <xinghe2@h-partners.com> - 8.4.0-19
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:curl_path: make SFTP handle a path like /~ properly
* Wed May 07 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-18
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:enable multi-thread testcase to shorten build-time
* Tue May 06 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:libssh: fix freeing of resources in disconnect
openssl: fix crash on missing cert password
* Tue Mar 25 2025 xingwei <xingwei14@h-partners.com> - 8.4.0-16
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:altsvc: avoid integer overflow in expire calculation
urlapi: fix redirect to a new fragment or query (only)
tool_getparam: clear sensitive arguments better
* Sat Feb 08 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-15
- Type:CVE
- CVE:CVE-2025-0167 CVE-2025-0725
- SUG:NA
- DESC:fix CVE-2025-0167 CVE-2025-0725
* Tue Jan 07 2025 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-14
- Type:CVE
- CVE:CVE-2024-11053
- SUG:NA
- DESC:fix CVE-2024-11053
* Mon Dec 09 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-13
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:cookie: treat cookie name case sensitively
* Sat Nov 30 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-12
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:multi: check that the multi handle is valid in curl_multi_assign
* Mon Nov 11 2024 yanglu <yanglu72@h-partners.com> - 8.4.0-11
- Type:CVE
- CVE:CVE-2024-9681
- SUG:NA
- DESC:fix CVE-2024-9681
* Fri Sep 20 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-10
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:url: allow DoH transfers to override max connection limit
* Thu Sep 12 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-9
- Type:CVE
- CVE:CVE-2024-8096
- SUG:NA
- DESC:fix CVE-2024-8096
* Thu Sep 05 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-8
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:revert modify licence from curl to MIT
* Thu Aug 15 2024 zhangxianjun <zhangxianjun@kylinos.cn> - 8.4.0-7
- modify licence from curl to MIT
* Wed Jul 31 2024 yinyongkang <yinyongkang@kylinos.cn> - 8.4.0-6
- Type:CVE
- CVE:CVE-2024-7264
- SUG:NA
- DESC:fix CVE-2024-7264
* Mon Jun 24 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-5
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:paramhlp: fix CRLF-stripping files with "-d @file"
libssh2: set length to 0 if strdup failed
openldap: create ldap URLs correctly for IPv6 addresses
multi: avoid memory-leak risk
tool_cfgable: free {proxy_}cipher13_list on exit
* Wed Jun 12 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-4
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:add version require of nghttp2 for libcurl
* Thu May 09 2024 baiguo <baiguo@kylinos.cn> - 8.4.0-3
- DESC: tool_cb_rea: limit rate unpause for -T . uploads
* Mon Apr 01 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-2
- Type:CVE
- CVE:CVE-2024-2004 CVE-2024-2398
- SUG:NA
- DESC:fix CVE-2024-2004 CVE-2024-2398
* Tue Jan 09 2024 zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-1
- Type:requirement
- CVE:NA
- SUG:NA
- DESC:update curl to 8.4.0
* Thu Dec 28 2023 zhouyihang <zhouyihang3@h-partners.com> - 8.1.2-7
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:transfer: also stop the sending on closed connection
openssl: avoid BN_num_bits() NULL pointer derefs
* Fri Dec 08 2023 zhouyihang <zhouyihang3@h-partners.com> - 8.1.2-6
- Type:CVE
- CVE:CVE-2023-46218 CVE-2023-46219
- SUG:NA
- DESC:fix CVE-2023-46218 CVE-2023-46219
* Thu Oct 12 2023 zhouyihang <zhouyihang3@h-partners.com> - 8.1.2-5
- Type:CVE
- CVE:CVE-2023-38545 CVE-2023-38546
- SUG:NA
- DESC:fix CVE-2023-38545 CVE-2023-38546
* Thu Sep 14 2023 gaihuiying <eaglegai@163.com> - 8.1.2-4
- Type:CVE
- CVE:CVE-2023-38039
- SUG:NA
- DESC:fix CVE-2023-38039
* Wed Sep 06 2023 yanglu <yanglu72@h-partners.com> - 8.1.2-3
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:vtls:avoid memory leak if sha256 call fails
urlapi:make sure zoneid is also duplicated in curl_url_dup
* Thu Jul 20 2023 zhouyihang <zhouyihang3@h-partners.com> - 8.1.2-2
- Type:CVE
- CVE:CVE-2023-32001
- SUG:NA
- DESC:fix CVE-2023-32001
* Sat Jul 15 2023 gaihuiying <eaglegai@163.com> - 8.1.2-1
- Type:requirement
- CVE:NA
- SUG:NA
- DESC:update to curl 8.1.2
* Sat Jun 10 2023 zhouyihang <zhouyihang3@h-partners.com> - 7.88.1-4
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:disable valgrind in tests
* Thu Jun 08 2023 xingwei <xingwei14@h-partners.com> - 7.88.1-3
- Type:CVE
- CVE:CVE-2023-28320,CVE-2023-28321,CVE-2023-28322
- SUG:NA
- DESC:fix CVE-2023-28320,CVE-2023-28321,CVE-2023-28322
* Wed Mar 22 2023 zengwefeng <zwfeng@huawei.com> - 7.88.1-2
- Type:cves
- ID:CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27537 CVE-2023-27538
- SUG:NA
- DESC:fix CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27537 CVE-2023-27538
* Thu Mar 02 2023 xinghe <xinghe2@h-partners.com> - 7.88.1-1
- Type:requirements
- ID:NA
- SUG:NA
- DESC:upgrade to 7.88.1
* Sat Feb 18 2023 xinghe <xinghe2@h-partners.com> - 7.86.0-3
- Type:cves
- ID:CVE-2023-23914 CVE-2023-23915 CVE-2023-23916
- SUG:NA
- DESC:fix CVE-2023-23914 CVE-2023-23915 CVE-2023-23916
* Thu Dec 22 2022 zhouyihang <zhouyihang3@h-partners.com> - 7.86.0-2
- Type:cves
- ID:CVE-2022-43551 CVE-2022-43552
- SUG:NA
- DESC:fix CVE-2022-43551 CVE-2022-43552
* Wed Nov 16 2022 xinghe <xinghe2@h-partners.com> - 7.86.0-1
- Type:requirements
- ID:NA
- SUG:NA
- DESC:upgrade to 7.86.0
* Thu Oct 27 2022 yanglu <yanglu72@h-partners.com> - 7.79.1-12
- Type:cves
- CVE:CVE-2022-32221 CVE-2022-42915 CVE-2022-42916
- SUG:NA
- DESC:fix CVE-2022-32221 CVE-2022-42915 CVE-2022-42916
* Tue Oct 11 2022 huangduirong <huangduirong@huawei.com> - 7.79.1-11
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:Move autoreconf to build
* Thu Sep 01 2022 zhouyihang <zhouyihang@h-partners.com> - 7.79.1-10
- Type:cves
- CVE:CVE-2022-35252
- SUG:NA
- DESC:fix CVE-2022-35252
* Thu Jul 28 2022 gaihuiying <eaglegai@163.com> - 7.79.1-9
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:just rebuild release to 7.79.1-9
* Mon Jul 25 2022 gaihuiying <eaglegai@163.com> - 7.79.1-8
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:fix build error when add --disable-http-auth configure option
* Tue Jul 05 2022 gaihuiying <eaglegai@163.com> - 7.79.1-7
- Type:cves
- CVE:CVE-2022-32207
- SUG:NA
- DESC:fix CVE-2022-32207 better
* Wed Jun 29 2022 gaihuiying <eaglegai@163.com> - 7.79.1-6
- Type:cves
- CVE:CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208
- SUG:NA
- DESC:fix CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208
* Tue May 17 2022 gaihuiying <eaglegai@163.com> - 7.79.1-5
- Type:cves
- CVE:CVE-2022-27781 CVE-2022-27782
- SUG:NA
- DESC:fix CVE-2022-27781 CVE-2022-27782
* Sat May 14 2022 gaoxingwang <gaoxingwang1@huawei.com> - 7.79.1-4
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:fix dict and neg telnet server start fail in upstream testcase
* Fri May 06 2022 gaihuiying <eaglegai@163.com> - 7.79.1-3
- Type:cves
- CVE:CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776
- SUG:NA
- DESC:fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776
* Mon Apr 25 2022 gaoxingwang <gaoxingwang1@huawei.com> - 7.79.1-2
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:enable check in spec
* Thu Jan 20 2022 gaoxingwang <gaoxingwang@huawei.com> - 7.79.1-1
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:update curl to 7.79.1
* Wed Sep 29 2021 yanglu <yanglu72@huawei.com> - 7.77.0-3
- Type:CVE
- CVE:CVE-2021-22945 CVE-2021-22946 CVE-2021-22947
- SUG:NA
- DESC:fix CVE-2021-22945 CVE-2021-22946CVE-2021-22947
* Fri Aug 13 2021 gaihuiying <gaihuiying1@huawei.com> - 7.77.0-2
- Type:CVE
- CVE:CVE-2021-22925 CVE-2021-22926
- SUG:NA
- DESC:fix CVE-2021-22925 CVE-2021-22926
* Thu Jul 8 2021 gaihuiying <gaihuiying1@huawei.com> - 7.77.0-1
- Type:requirement
- CVE:NA
- SUG:NA
- DESC:update curl to 7.77.0
* Tue Jun 8 2021 gaihuiying <gaihuiying1@huawei.com> - 7.71.1-9
- Type:CVE
- CVE:CVE-2021-22897 CVE-2021-22898
- SUG:NA
- DESC:fix CVE-2021-22897 CVE-2021-22898
* Tue Apr 20 2021 gaihuiying <gaihuiying1@huawei.com> - 7.71.1-8
- Type:CVE
- CVE:CVE-2021-22890
- SUG:NA
- DESC:fix CVE-2021-22890
* Thu Apr 8 2021 xieliuhua <xieliuhua@huawei.com> - 7.71.1-7
- Type:CVE
- CVE:CVE-2021-22876
- SUG:NA
- DESC:fix CVE-2021-22876
* Tue Jan 26 2021 wangxiaopeng <wangxiaopeng7@huawei.com> - 7.71.1-6
- Type:CVE
- CVE:CVE-2020-8285
- SUG:NA
- DESC:fix CVE-2020-8285
* Tue Jan 19 2021 xielh2000 <xielh2000@163.com> - 7.71.1-5
- Type:CVE
- CVE:CVE-2020-8286
- SUG:NA
- DESC:fix CVE-2020-8286
* Mon Jan 18 2021 xihaochen <xihaochen@huawei.com> - 7.71.1-4
- Type:CVE
- CVE:CVE-2020-8284
- SUG:NA
- DESC:fix CVE-2020-8284
* Tue Jan 5 2021 gaihuiying <gaihuiying1@huawei.com> - 7.71.1-3
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:fix downgrade error
* Mon Dec 28 2020 liuxin <liuxin264@huawei.com> - 7.71.1-2
- Type:cves
- ID:CVE-2020-8231
- SUG:NA
- DESC:fix CVE-2020-8231
* Fri Jul 24 2020 zhujunhao <zhujunhao8@huawei.com> - 7.71.1-1
- Update to 7.71.1
* Thu Apr 9 2020 songnannan <songnannan2@huawei.com> - 7.66.0-3
- split out the libcurl and libcurl-devel package
* Tue Mar 17 2020 chenzhen <chenzhen44@huawei.com> - 7.66.0-2
- Type:cves
- ID:CVE-2019-15601
- SUG:NA
- DESC:fix CVE-2019-15601
* Sat Jan 11 2020 openEuler Buildteam <buildteam@openeuler.org> - 7.66.0-1
- update to 7.66.0
* Sat Dec 21 2019 openEuler Buildteam <buildteam@openeuler.org> - 7.61.1-4
- Type:cves
- ID:CVE-2019-5481 CVE-2019-5482
- SUG:NA
- DESC:fix CVE-2019-5481 CVE-2019-5482
* Wed Sep 18 2019 guanyanjie <guanyanjie@huawei.com> - 7.61.1-3
- Init for openEuler