When will libcurl.dll be updated in the Microsoft Azure Service Fabric Runtime product?

UnderwoodMarlene-1858 hi & thx for join me at Q&A platform,

There doesn't appear to be a published schedule for updating the libcurl.dll bundled with the Windows Service Fabric Runtime. The current Service Fabric release notes don't announce a move from 8.13.0 to a newer libcurl version, so I wouldn't assume that 8.21.0 will be included in the next runtime update.

I also wouldn't manually replace libcurl.dll inside the Service Fabric Runtime installation. It's a Microsoft-packaged runtime dependency, and replacing an individual binary can leave the installation in an unsupported or incompatible state. The supported version should normally come through a Service Fabric Runtime update.

If this request is driven by a specific CVE or security scanner finding, I'd open a Service Fabric support case and provide the CVE, affected Service Fabric Runtime version and detected libcurl.dll version. The Service Fabric engineering team can confirm whether that vulnerability actually affects their build of libcurl and, if it does, which runtime release will contain the patched binary.

There doesn't seem to be a separate Microsoft download of a newer libcurl.dll specifically supported as a drop-in replacement for the copy shipped with Service Fabric. For a required security remediation, the important question for Microsoft is therefore the patched Service Fabric Runtime version, rather than how to replace libcurl.dll independently.

rgds,

Alex