curl: CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)

Summary: The CVE-2026-11586 fix 849317ff5c, "ws: make pong sending lazy" adds the automatic PONG only when the WebSocket send buffer has room, but it put that check in wsflush lib/ws.c:1712. curlwsrecv, the receive call of the documented CONNECTONLY model, still calls wsencaddpending without it a...

curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...