I have discussed this with Daniel Stenberg himself in this thread: https://curl.se/mail/lib-2023-11/0017.html The summary is: - It was never intended/expected that CURLOPT_READFUNCTION would be called more after already returning EOF once. libcurl has been modified to never do this anymore (in master, to be released in what comes after 8.4.0). - The problem has been tracked down to a particular case that could reproduce only if using HTTP/2 and only in cURL versions 7.84.0 – 8.1.2 (inclusive, roughly between June 2022 and July 2023). The same misbehavior is still technically possible in newer versions, but not happening in practice. Therefore, I believe nothing strongly _needs_ to be done on the Git side.