When user sets CURLOPT_SSLCERT but leaves CURLOPT_SSLKEY unset assume the path passed in CURLOPT_SSLCERT holds the ssl key which is what we do in openssl implementation.
Closed #14007
Question When studying certificate mechanisms, I discovered that curl requests do not encounter problems even without intermediate certificates. While web browsers automatically fetch intermediate ...
Here's another good idea coming from the #curl user survey:
Support "curl -h --insecure" etc to output the manpage section for the --insecure command line option in the terminal. Should be possible to work with either long or short versions of command line options.
Support "curl -h --insecure" etc to output the manpage section for the --insecure command line option in the terminal. Should be possible to work with either long or short versions of command line ...
Allow resolves for a hostname independent of port number, to a fixed address. Resolves to a fixed port number have priority.
Also works if the hostname itself is using "*" to catch all hostnames.
A...
@bagder shares his guiding principles for BDFL’ing curl, gives us his perspective on the state of the internet, talks financial independence, ensuring curl won’t be the next XZ & more!
Daniel Stenberg shares his guiding principles for BDFL’ing curl, gives us his perspective on the state of the internet, talks financial independence, ensuring curl won’t be the next XZ & more!
Hello cURL team,
I am splitline from DEVCORE Research Team. We recently found a vulnerability on cURL. We have reproduced the issues in the latest version of cURL (curl-8.8.0_1) and would like to...
Hello, I recently read the blog entry about curl no longer leaking .onion domains into the DNS, which is great. However, curl still leaks .i2p domains. Like Tor, I2P is a "darknet" or overlay netwo...
If you subscribe to my weekly #email, you will get a full nerd report every week about what I have been up to and will do next. Mostly about #curl, open source, networking and related stuff.
At no cost. No ads. No requirements. If you want to.
This is an idea about using a resident agent to hold information where curl can store/retrieve information that is relevant for transfers. This should similar to ssh-agent (or maybe even use that, ...
It would be nice to expose the number of --retry retries that were required to complete a request: curl --retry 5 --retry-delay 2 --silent --write-out '%{num_retries} attempts\n' https://unreliable...
Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension that enables a TCP connection to use different paths.
Multipath TCP has been used for several use cases. On smartphones, MPTCP...
DragonFly BSD changed the time unit for TCP keep-alive from milliseconds to seconds since v5.8, thus setting the keepalive options with milliseconds with curl/libcurl will result in unexpected beha...
Because I was reminded. Remember when PowerShell went Open Source eight years ago and I submitted a PR the next day proposing to remove the #curl alias?
#Windows users running stupid scanners now contact us for support regarding CVE-2023-46218 which the scanners say affects #curl 8.4.0 shipped by Microsoft.
It would, if their version was built to use #iibpsl, a prereq for this CVE, which #Microsoft does not.
