Libcurl <8.18.0 security vulnerability

[josill]

Bump libcurl to <=8.18.0 because the version from 7.17.0 up to 8.17.0 have a security vulnerability: https://www.tenable.com/plugins/nessus/291360

[andreifloroiu]

Bump desired here also

[janjwerner-confluent]

Folks,
I"m sorry this dropped out of my radar. This should be resolved in:
#5346
Emanuele Sabellico (@emasab)

[kikaragyozov]

We're being affected by this as well.

Jan Werner (@janjwerner-confluent) could you verify that the pull request addresses both of these dependencies?

[janjwerner-confluent]

Kiril Karagyozov (@kikaragyozov)
There are currently no updates for branch 3.3.2,
I'm suggesting upgrade to openssl LTS version 3.5 that should help , however the latest available in vcproj is 3.5.4#0 - and to my best knowledge it does not resolve CVE-2025-15467

[kikaragyozov]

Kiril Karagyozov (@kikaragyozov) There are currently no updates for branch 3.3.2, I'm suggesting upgrade to openssl LTS version 3.5 that should help , however the latest available in vcproj is 3.5.4#0 - and to my best knowledge it does not resolve CVE-2025-15467

Could you please bump the OpenSSL version to any patched version which addresses the CVE-2025-15467 vulnerability report?

Those versions are:

• OpenSSL 3.6.1 or later
• OpenSSL 3.5.5 or later
• OpenSSL 3.4.4 or later
• OpenSSL 3.3.6 or later
• OpenSSL 3.0.19 or later