Two years ago we switched all #curl documentation into markdown as the source format. We generate man pages and more from those.
daniel.haxx.se/blog/2024/01/23…
I trust you have figured out already that I have the highest ambitions for the curl documentation. I want everything documented in a clear, easy-to-read and easy-to-find manner.daniel.haxx.se
"We will ban you and ridicule you in public if you waste our time on crap reports."
curl.se/.well-known/security.t…
#curl
#curl is RFC 9116 compliant
curl.se/.well-known/security.t…
https :// curl.se / .well-known / security.txt
We seem to have data that confirms that the #curl bug-bounty has received a steep increased submission rate through 2025, while several other Open Source programs also hosted on Hackerone have not. (There's a graph coming in my pending blog post.)
What could possibly be the reason for us taking more heat and more junk than others? Why oh why?
With the four new ones from my blog post yesterday, we are at 98 graphs on the #curl dashboard.
I think I might go wild and celebrate reaching the mythical 100 graphs with a blog post if we get there.
libcurl memory use some years later
A look into memory consumption in #curl over time
daniel.haxx.se/blog/2026/01/21…
One of the trickier things in software is gradual degradation. Development that happens in the wrong direction slowly over time which never triggers any alarms or upset users.daniel.haxx.se
I use #curl _a lot_ when probing exploitable stuff.
I should donate to curl.
*30 seconds later*
I have now donated to curl.
I re-implemented the rate limiting in #curl, coming in the next release. A description.
eissing.org/icing/posts/curl-r…
The curl project merged #19384, #20033 and #20228 which re-implements rate limiting of transfers in libcurl. This will be part of the upcoming 8.19.0 release at the beginning of March 2026.icing's blog
Today I received *two* seemingly independent offers to start a "web3" funding initiative for #curl.
That feels like two too many. No thanks. Take your scam offers to someone else.
The SSL options CURLOPT_ISSUERCERT, CURLOPT_SSL_EC_CURVES, and CURLOPT_CRLFILE were silently accepted by curl_easy_setopt() even when the SSL backend doesn't support them. This could mislead ap...GitHub
https://pubs.opengroup.org/onlinepubs/007904875/functions/sigaction.html SA_SIGINFO should not be set when it is using sa_handler. If we set sa_handler as SIG_IGN and sa_flags with SA_SIGINFO.The s...GitHub
Autotools ./configure requires selecting a TLS backend explicitly (or using --without-ssl). Several docs/examples still show ./configure without any TLS backend flag, which fails on current sources...GitHub
Now with MQTTS (#curl)
daniel.haxx.se/blog/2026/01/19…
Back in 2020 we added MQTT support to curl. When curl 8.19.0 ships in the beginning of May 2026, we have also added MQTTS; meaning MQTT done securely over TLS.daniel.haxx.se
As curl now supports TLS (mqtts), it is no longer necessary to list it as a limitation in the docs.GitHub
My first 20,000 #curl commits
daniel.haxx.se/blog/2026/01/17…
Some of you may of course think what, only 20,000 commits after almost thirty years in the project, what kind of slacker is that guy? But yes, today I merged my 20,000th commit into the curl repository - out of a total of 37,604 commits (53%).daniel.haxx.se
More HTTP/3 focus, one backend less
(#curl drops OpenSSL-QUIC support)
daniel.haxx.se/blog/2026/01/17…
In the curl project we have a long tradition of offering multiple optional backends for specific protocols. In this spirit we have added experimental support for a number of different HTTP/3 + QUIC backends over time.daniel.haxx.se
Say hello to the 29th URL scheme #curl supports MQTTS://
github.com/curl/curl/pull/1941…
test cases documentationGitHub
The IMAP response parser would incorrectly detect {size} literals inside quoted strings, causing protocol desynchronization. For example, a server response like: * 1 FETCH (BODY[HEADER] "Subje...GitHub
»curl — Projekt beendet Bug-Bounty-Programm:
curl-Maintainer @bagder hat das Ende des Bug-Bounty-Programms angekündigt. Unbrauchbare KI-Meldungen nahmen wohl überhand.«
Ach was, die KI ist künstlich aber nicht intelligent oder was nun?!?? Ich bin sogar der Meinung, dass dies was die KI angeht noch das rel. kleinste "Problem" ist. Schade dass deswegen das curl Bug-Bounty aufgelöst wird.
🧑💻 heise.de/news/curl-Projekt-bee…
#curl #ki #bugbounty #unbrauchbar #ai #uberhang #ausserkontrolle #it #ittools
curl-Maintainer Daniel Stenberg hat das Ende des Bug-Bounty-Programms angekündigt. Unbrauchbare KI-Meldungen nahmen wohl überhand.Dirk Knop (heise online)
"This is a vulnerability"
"No, it isn't"
"Yes, it is"
"Prove it!"
"Ok, it may not be now...
...but it is a trap for future developers!"
Security reporting for the utterly deranged.
#curl
Meanwhile, we have now added 4 lines of code for every line of code still remaining in #curl
This means that on average, every single line of production code has been touched four times. Written once, then updated three more times. And yeah, some lines of course many more times than average, and some less so.
It's about sustainability too. #curl is a small project. We cannot spend multiple hours every day arguing with people who want money for having found what is perhaps a bug - but often is not even that.
It drains us. It drowns us.
Onward and upward!
It is our moral imperative to consider the "real world" and actual users when assessing the possible security impact of a reported #curl issue. If we deem that there is likely to be zero affected users, then we do more damage than good by insisting on doing the security dance for the issue.
Then we end up with a severity level that is below LOW, and then we treat it as a bug instead. For the good of mankind.
To be frank: the report quality on Hackerone is so low by now that the #curl team decided to make CVEs based only on the coolness of the reporter‘s username.
💁🏻♂️😌
On the morning of the 13th day of the year we have received *checks notes* 13 #curl vulnerability reports on Hackerone this year.
None a confirmed vulnerability.
Augment (which gave the #curl project free access) is changing pricing (again) in what seems to be a 10x increase.
Augment pricing changes from ‚messages‘ (number of answer which you control) to ‚credit‘ (which is effort controlled by Augment).
And this is probably still not enough to cover their real costs, not even speaking of profit.
Wherever you stand on the LLM debate, don‘t become dependant on those companies. Their business model sucks.
theregister.com/2025/10/15/aug…
: Second huge increase in six months sees some devs heading for the exitTim Anderson (The Register)
Like so many other software projects the curl project has copyright mentions at the top of almost every file in the source code repository. Like Copyright (C) 1998 - 2022, Daniel Stenberg ...daniel.haxx.se
#curl 8.18.0 with Daniel Stenberg
Daniel talks about the six(!) new security advisories, the changes and the most important bugfixes from the curl 8.18.0 release.YouTube
#curl 8.18.0 has been released. This release fixes 2 medium and 4 low level vulnerabilities:
- CVE-2025-13034: No QUIC certificate pinning with GnuTLS curl.se/docs/CVE-2025-13034.ht…
- CVE-2025-14017: broken TLS options for threaded LDAPS curl.se/docs/CVE-2025-14017.ht…
- CVE-2025-14524: bearer token leak on cross-protocol redirect curl.se/docs/CVE-2025-14524.ht…
- CVE-2025-14819: OpenSSL partial chain store policy bypass curl.se/docs/CVE-2025-14819.ht…
- CVE-2025-15079: libssh global knownhost override curl.se/docs/CVE-2025-15079.ht…
- CVE-2025-15224: libssh key passphrase bypass without agent set curl.se/docs/CVE-2025-15224.ht…
I discovered the last 2 vulnerabilities.
Download curl 8.18.0 from curl.se/download.html
#vulnerabilityresearch #vulnerability #cybersecurity #infosec
