C-Kermit 11 Ships as First Full Release in 15 Years, Modernizing the 45-Year-Old File-Transfer Protocol
John Goerzen released C-Kermit 11 on August 3, 2026, the first full release of the Kermit file-transfer protocol since 2011, adding IPv6 support and fixing CVE-2025-68920.
Overview
John Goerzen released C-Kermit 11 on August 3, 2026, marking the first full release of the Kermit file-transfer protocol in 15 years, according to Goerzen’s announcement and confirmed by LWN.net, which reported the release as “the first release of this file-transfer utility in 15 years.” The new version, tagged v11.0.506 in the GitHub release notes, is the first non-beta release since 9.0.302 shipped in 2011.
What We Know
Kermit began in 1981, when Frank da Cruz and Bill Catchings designed the protocol at Columbia University to move files between incompatible systems such as the DEC-20 and IBM mainframes, which struggled with basic tasks like transferring 8-bit files over 7-bit links. By 1982 the protocol had spread to MS-DOS and Unix, and C-Kermit — the C-language implementation — became its flagship version, eventually gaining TCP support, a scripting language, and an interactive command-line interface, Goerzen’s post says. Over the decades Kermit has flown on the International Space Station and been used to collect data from hurricane sensors, among other applications, per the same post. Columbia’s own Kermit Project archive notes that a laptop running Kermit 95 was installed aboard the station via a CD-ROM launched with the CSLM-2 hardware in December 2002.
Columbia funded and controlled the Kermit Project for its first three decades, charging for commercial use in a way that kept it out of Linux distributions. In 2011, Columbia canceled the Kermit Project and released C-Kermit as open source under a BSD license, and Frank da Cruz continued volunteer maintenance with alpha and beta releases until his retirement from the project in 2025.
Goerzen, who maintains Kermit packaging for Debian, took over active development from there. As Debian’s maintainer, he wrote that he noticed the software “wasn’t matching modern expectations,” citing security and outdated character-set and line-ending conversion defaults that occasionally caused data corruption — the same passage LWN.net quoted in its own coverage. Because his changes grew beyond what would fit in a Debian patch series, Goerzen created a new project, Open Kermit, “to coordinate future development in the open and keep Kermit going,” as he put it in the announcement.
The release adds IPv6 support to C-Kermit’s TCP stack, with graceful fallback to IPv4 on systems or connections that don’t support it, according to the GitHub release notes. Goerzen introduced C-based unit tests and a Python-based end-to-end regression suite; the release notes state: “Over 1700 test cases are being run” through continuous integration validated on Linux, macOS, FreeBSD, and NetBSD, while Goerzen separately described the combined unit and end-to-end suites in his own post as running “nearly 2000 test cases in total.” The new tests were also run against gkermit, E-Kermit, and the 2011 C-Kermit 9.0.302 release for compatibility, the release notes say.
On security, the release fixes CVE-2025-68920, a flaw the GitHub release notes describe as “insecure defaults that previously would let a malicious remote kermit server perform actions on your local workstation.” The National Vulnerability Database lists the issue, present in versions through 10.0 Beta.12, with a CVSS 3.1 score of 8.9 (“HIGH”) under CWE-862, missing authorization. To close it, C-Kermit 11 changes the default for SET FILE COLLISION from BACKUP to REJECT, since the prior default “would let a malicious remote overwrite sensitive local files (eg, .bashrc),” the release notes state, and switches the default transfer mode from automatic to manual, since automatic mode “would override the binary file type in surprising circumstances, leading to data loss.”
Goerzen dedicated the release to da Cruz, writing in the changelog that da Cruz “was directly involved with Kermit for 44 years, from its initial design in 1981 all the way through 2025,” adding, “I know of no other Open Source project where the founder remains so personally involved for so long.” The Open Kermit project site echoes the same figure, describing itself as carrying the project forward “after the retirement of one of Kermit’s founders after 44 years.”
What We Don’t Know
Neither Goerzen’s announcement nor the GitHub release notes state whether major Linux distributions plan to package C-Kermit 11 by default, or on what timeline. It is also not yet established how quickly downstream users — many of whom, per LWN’s report, have not thought about C-Kermit “in years” — will move off the 2011-era 9.0.302 release or the various 10.x betas that distributions had been shipping.