Puppet Core 8.17.0

Released February 2026. This version of Puppet Core includes improvements to help prevent security vulnerabilities.

This version of Puppet Core will end of life (EOL) when it is superseded by the next release. Learn more about the Puppet Core platform lifecycle and EOL.

On this page:

Security updates

Updated curl

Curl was updated to version 8.18.0 to address CVE-2025-11563, CVE-2025-10966, CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, and CVE-2025-15224. PA-8071

Updated Ruby

Ruby was updated to version 3.2.10 to address CVE-2025-61594 and CVE-2025-58767. PA-8112

Updated OpenSSL

OpenSSL was updated to version 3.0.19 to address CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. PA-8143

Deprecations and removals

Ruby API removed

The ruby API was removed from leatherman. PA-8029

Brotli and zstd removed in agent curl builds

Removed brotli and zstd in agent curl builds. This does not affect the function of Puppet or PXP agents. PA-8064