Do minor curl vulnerabilities in the open 🔗
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability re [...]
daniel.haxx.se
Posts
OSI approved the curl license 🔗
curl started out GPL licensed, as direct inheritance from its httpget days, but in October 1998 we switched to the Mozilla Public License (MPL). In 20 [...]
A curl audit by Aisle 🔗
Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source c [...]
A UAF turned RCE 🔗
In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE [...]
curl 8.23.0 🔗
Release presentation Numbers the 277th release4 changes42 days (total: 10,929)281 bugfixes (total: 14,770)476 commits (total: 40,084)0 new public libc [...]
A slightly faster slimmer curl 🔗
Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of t [...]
The 2026 curl team 🔗
The curl security team happens to also double as the curl core team. The small group of people who assess security reports and take project decisions. [...]
Twenty-two pending curl vulnerabilities 🔗
On October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of [...]
25 years on Apple computers 🔗
Exactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS. Exactly t [...]
curl 8.22.0 🔗
Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the fol [...]