After applying the recommended security update Curl 8.1.0 to Slackware-64 15.0, some well-formed URLs cannot be parsed by the curl command, which throws a parse error:
Code:
$ curl --version
curl 8.1.0 (x86_64-pc-linux-gnu) libcurl/8.1.0 OpenSSL/1.1.1t zlib/1.2.13 brotli/1.0.9 zstd/1.5.5 c-ares/1.19.1 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.0) libssh2/1.10.0 nghttp2/1.46.0
Release-Date: 2023-05-17
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd
$ curl https://123.anydomain.com/
curl: (3) URL using bad/illegal format or missing URL
As an example of expected behavior, here is curl 7.86:
Code:
$ curl --version
curl 7.86.0 (x86_64-pc-linux-gnu) libcurl/7.86.0 OpenSSL/1.1.1t zlib/1.2.13 brotli/1.0.9 zstd/1.5.5 c-ares/1.19.1 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.0) libssh2/1.10.0 nghttp2/1.46.0
Release-Date: 2022-10-26
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd
$ curl https://123.anydomain.com/
curl: (6) Could not resolve host: 123.anydomain.com
Maybe it needs to be said that the problem is not limited to hostnames that cannot be resolved, as in the example above. All purely numeric hostnames I've tried, whether resolvable or not, exhibit this behavior.
My specific issue is that Zabbix uses curl when given a URL to monitor, and can no longer monitor a URL of the form
https://999999.app.netsuite.com/ which is how we check end-to-end connectivity to the Oracle NetSuite accounting application.
Maybe it also needs to be said that purely numeric hostnames have been part of the hostname standards for more than twenty years.
Curl patch level 8.1.0 breaks all-numeric hostnames
