curl CVE-2026-6429

Upgrade curl to the patched version released by the curl project (exact fix version not specified in available data; consult https://curl.se/docs/CVE-2026-6429.html and the oss-security disclosure at https://www.openwall.com/lists/oss-security/2026/04/29 for the specific release version). Until patching is possible, mitigate by avoiding netrc file usage and instead passing credentials via environment variables (CURL_NETRC_FILE unset) or command-line flags, which bypass the pooled connection logic. Alternatively, disable connection reuse for requests using netrc credentials by setting CURLOPT_FRESH_CONNECT or using the --disable-epsv flag depending on curl version. For systems where curl is embedded or compiled into applications, ensure library dependencies are updated to the patched version-note that binary curl upgrades alone will not fix statically-linked applications. Trade-off: disabling connection pooling reduces performance for high-volume request scenarios but eliminates the reuse-based credential leak vector.