From 27c3e0839af9d1b19fb0de6a53b4d0b01167c936 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 3 Mar 2026 23:06:24 +0100
Subject: [PATCH] content_encoding: return 'identity' if none other exists

This fixes a regression and accidental changed behavior shipped in
8.18.0 (via 6b9c75e219cdcfd3e17e78).

When the setopt is set to "" and curl is built without support for a
single compression algorithm, it used to use "identity" but recently did
not.

Spotted by Codex Security
Closes #20805
---
 lib/content_encoding.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/content_encoding.c b/lib/content_encoding.c
index a79e00c617..aa35da840b 100644
--- a/lib/content_encoding.c
+++ b/lib/content_encoding.c
@@ -622,6 +622,9 @@ char *Curl_get_content_encodings(void)
         result = curlx_dyn_add(&enc, ce->name);
     }
   }
+  if(!result && !curlx_dyn_len(&enc))
+    result = curlx_dyn_add(&enc, CONTENT_ENCODING_DEFAULT);
+
   if(!result)
     return curlx_dyn_ptr(&enc);
   return NULL;