- CVE-2026-4873: do not reuse a clear-text STARTTLS connection when the new transfer requires TLS, so an IMAP, SMTP or POP3 request that mandates TLS is not sent over an unencrypted connection - CVE-2026-6253: restore the proxy credentials set via options on every redirect so credentials belonging to the first proxy are not disclosed to a second, different proxy - CVE-2026-6429: drop credentials that were not set through CURLOPT_USERNAME on redirect so a netrc password established for the first host is not sent to the redirect target over a reused connection or proxy - CVE-2026-8924: trim trailing dots from the request and cookie domains before the public suffix list check so a trailing-dot domain cannot set a super cookie scoped to an unrelated site