Attacker-controlled buffer overflow. CISA "vulnrichment" will assign a 9.8 assuming code execution :(

Indeed, using a "more than twenty-one years" old software: "a spectacularly bad position". (CVECrowd.com/ #cvecowd to check the noise)

“If there actually exist users vulnerable to this flaw in the world, they most likely already have worse problems than this to deal with.” 🤣 #truth

Forbes headline tomorrow: "Curl maintainer tells literally everyone on Earth to do these 4 things immediately."

I'm waiting for the "everyone should have used Rust 21 years ago" comments.

the hackerone report behind this is now also public: hackerone.com/reports/2956023

thank you for writing and publishing security advisory like this. It's always a pleasure to read them. Honest. Detailed. Precise. Thanks! Keep on the great work!

nice commentary re 20 old versions! Made me laugh. Thanks!