30 years of Internet transfers with curl 🔗
Thirty years ago, on November 11, 1996 the young Brazilian student Rafael Sagula posted the source code for his tiny HTTP download tool online. That w [...]
daniel.haxx.se
Posts
Scrutinize our assessments 🔗
I recently blogged about how the curl project switched to doing all handling of vulnerabilities at severity LOW and MEDIUM in the public. Let me now d [...]
“ignore the slop” 🔗
Lots of people who are against the use of AI for all its ethical and inherent issues tell me this. Just ignore it. Don’t let big AI control us. The “s [...]
Do minor curl vulnerabilities in the open 🔗
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability re [...]
OSI approved the curl license 🔗
curl started out GPL licensed, as direct inheritance from its httpget days, but in October 1998 we switched to the Mozilla Public License (MPL). In 20 [...]
A curl audit by Aisle 🔗
Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source c [...]
A UAF turned RCE 🔗
In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE [...]
curl 8.23.0 🔗
Release presentation Numbers the 277th release4 changes42 days (total: 10,929)281 bugfixes (total: 14,770)476 commits (total: 40,084)0 new public libc [...]
A slightly faster slimmer curl 🔗
Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of t [...]
The 2026 curl team 🔗
The curl security team happens to also double as the curl core team. The small group of people who assess security reports and take project decisions. [...]