Puppet Core 8.17.0

Released February 2026. This version of Puppet Core includes improvements to help prevent security vulnerabilities.

On this page:

Security updates

Updated curl

Curl was updated to version 8.18.0 to address CVE-2025-11563, CVE-2025-10966, CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, and CVE-2025-15224. PA-8071

Updated Ruby

Ruby was updated to version 3.2.10 to address CVE-2025-61594 and CVE-2025-58767. PA-8112

Updated OpenSSL

OpenSSL was updated to version 3.0.19 to address CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. PA-8143

Deprecations and removals

Ruby API removed

The ruby API was removed from leatherman. PA-8029

Brotli and zstd removed in agent curl builds

Removed brotli and zstd in agent curl builds. This does not affect the function of Puppet or PXP agents. PA-8064