curl CIDR Bypass Fails While --noproxy '*' Works
Use the actual client and linked library version to explain bypass feature differences instead of blaming a whole operating-system release.
A request to a literal private IP uses the proxy with a subnet exception, but goes direct with --noproxy '*'. That does not prove the operating system ignores every proxy exception.
The client has demonstrated one understood bypass form. The next question is whether it implements the range form you supplied.
curl added CIDR matching for these exceptions in 7.86.0. A machine running a newer-looking operating-system release can still have a client or linked library from another version line. Check the executable actually invoked and its linked libcurl, not just the OS name in the issue title.
An application using libcurl can differ from the standalone curl command as well. Distribution patches can matter, so use the installed package's feature documentation when the base version alone is inconclusive.
Keep the request input exact. A hostname that resolves into the subnet is another case from a URL containing the literal address. A supported CIDR parser does not automatically perform a DNS lookup to turn every name into an address-based bypass decision.
Collect the client identity, exact URL, exception value, and controlled result before replacing packages or generating an enormous list of individual addresses. A global all-hosts bypass is useful evidence about the comparison; it is not automatically the intended permanent routing policy.