sgcIndy 2026.8.0 Latest
- 2026.8.0: 2026 August
- NewNew TIdSocketHandle.SetReceiveTimeout method, the counterpart of SetSendTimeout, so a connection that goes silent fails cleanly instead of freezing the thread that was reading.
- FixedFixed a misleading error when a TLS connection failed, for example "error:00000006:lib(0):func(0):EVP lib". The real reason reported by OpenSSL was thrown away before the exception was raised, so the text shown had nothing to do with the real problem. The exception now shows the error reported by OpenSSL.
- FixedFixed a problem when the certificate file contained the certificate and the private key together. An error was left pending inside OpenSSL and could affect a later call. Real errors while reading the certificate chain were ignored too. Both cases are now handled properly.
- FixedThe OpenSSL options to disable old TLS versions, disable compression, disable renegotiation and prefer the server cipher order were ignored when the library loaded was OpenSSL 1.1 or later. They are now applied.
- FixedImproved the error when a PKCS#12 certificate (.p12 or .pfx) cannot be read because it uses an old algorithm such as RC2 40-bit. OpenSSL 3 moved those algorithms to the legacy provider, and the message now explains how to enable it.
- FixedFixed the error reported when a PKCS#12 private key fails to load, it named the certificate function instead of the private key function.
- FixedFixed a TLS connection writing past the end of its read buffer when the other side sent several encrypted records together in the same packet, which could overwrite the memory next to the buffer and crash the application. The buffer was told it had more free space than it really had. The data read during the handshake was cut short in a similar way, and the protocol name agreed through ALPN was read past its end because it does not arrive as text ending in a zero byte.
- FixedFixed the limit on the number of response headers in the HTTP client never being applied, so a server could send an endless stream of headers until the client ran out of memory. Setting MaxHeaderLines to 0, which means no limit, had the opposite effect and threw away every response header, including Content-Length and Location.
- FixedFixed an NTLM authentication challenge shorter than expected being read past its end, so the value used to answer it could be taken from unrelated memory and the client could crash. The challenge is now checked before it is used, including its signature and its message type.
- FixedNTLM authentication now reports clearly that it cannot run, instead of sending an empty answer that no server can accept. The routines that calculate the NTLM response are not available unless SGC_NATIVE_CRYPTO is enabled in the project, and until now the client sent an empty response and the server answered 401 again, which looked like a wrong user name or password. On Windows nothing changes, NTLM is handled by the operating system through SSPI.
- FixedFixed a SOCKS5 UDP reply larger than the buffer of the caller being copied past the end of that buffer, and a reply that was truncated or that declared an address type the client does not know being read past its end.
- FixedFixed several problems talking to a SOCKS5 proxy when the address is a host name instead of an IP address. The reply from the proxy was read one byte short, so the first byte of the answer reached the application as if it were data, and the port was taken from the wrong position. In the reply to a UDP request, an IPv6 address had two of its bytes read as the port. Connecting through the proxy to a host name longer than 248 characters also wrote past the end of the buffer used to build the request.
- FixedImproved the error reported when the OpenSSL legacy provider cannot be loaded, it now names the provider module that could not be loaded and the directory where it was searched.