"Pretend that a ping pong ball represents a single #curl installation somewhere in the world..."
(blog post from 2020)
daniel.haxx.se/blog/2020/08/20…
Pretend that a ping pong ball represents a single curl installation somewhere in the world. Here's a picture of one to help you get an image in your head.daniel.haxx.se
### Summary A malicious WebSocket server can send a fragmented message (FIN=0) followed by a flood of continuation frames, causing the client (curl) to continuously allocate memory while waiting...HackerOne
Yesterday we saw 161 different versions of #curl make just over 1 million requests to www.bbc.co.uk & www.bbc.com.
The oldest version is 7.0.0 (1 request).
The newest version is 8.15.0 (18,969 requests).
I'd spotted a load of different cURL versions in something else so was curious how many versions we see.
sftp_download_stat, sftp_upload_init, sftp_quote_stat, sftp_readdir will translate LIBSSH2_ERROR_EAGAIN to CURLE_OK and set *block to TRUE, but outer loop do not check *block, result in busy loopGitHub
Meanwhile, if you abuse the API and don't comply, asan might complain but that's not a #curl security problem.
## Summary A **Use-After-Free (UAF)** vulnerability was discovered in `curl` at **`curl_trc.c:195`**. When processing specially crafted input, the code accesses memory after it has already been...HackerOne
The first release candidate for the pending #curl 8.16.0 release is up and if you have a chance, do try it out and report any and all issues you experience:
If the cookie returned by the server is expired, curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies) will still retrieve one expired cookie(Only the last one). Below is the test code: server...GitHub
My Midnight Battle with a curl Command A story of PowerShell, a annoying bug, and what stood between me and a dream internship in Japan. Obviously every problem has its own background story, It was …Shreeharsh Shinde (Medium)
car brands running #curl
(basically yesterday's tooting in blog form)
daniel.haxx.se/blog/2025/08/15…
Seven years ago I wrote about how a hundred million cars were running curl and as I brought up this blog post in a discussion recently, I came to reflect over how the world might have changed since. Is curl perhaps used in more cars now? Yes it is.daniel.haxx.se
On this day 26 years ago, we introduced the #curl option -#/--progress-bar when we released curl 5.10
You can now try out the #curl git mirror on @Codeberg: codeberg.org/curl/curl-mirror
Consider it a test pilot for now. We won't do PRs and issues there so there's an obvious risk this will just be too messy...
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS…Codeberg.org
Seven years ago I estimated a hundred million cars ran #curl. Eight of the ten biggest car brands used it then. All the top three ones.
It probably means that there are some additional cars using curl now. libcurl really.
daniel.haxx.se/blog/2018/08/12…
One of my hobbies is to collect information about where curl is used. The following car brands feature devices, infotainment and/or navigation systems that use curl - in one or more of their models.daniel.haxx.se
#curl tells the %time - extending -w once more
daniel.haxx.se/blog/2025/08/07…
The curl command line option --write-out or just -w for short, is a powerful and flexible way to extract information from transfers done with the tool. It was introduced already back in version 6.5 in the early 2000.daniel.haxx.se
I recently refreshed my #curl vs #wget page. What have I missed? For either tool.
daniel.haxx.se/docs/curl-vs-wg…
Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.daniel.haxx.se
curl_easy_reset() did not reset the rewind_read flag. This caused any handles that previously had a CURLE_SEND_FAIL_REWIND error to get stuck with that error, failing any subsequent requests, even ...GitHub
Another #curl security report that took some serious mind wrestling and debugging to get to the bottom of.
In the end I deem it not a security vulnerability but you can see how this is not an easy call.
## Summary: - Use-After-Free vulnerability that leads to arbitrary write/READ YES, I used IA along with mermaind editor (online one) to generate this graph that show these paths for...HackerOne
Add LibQurl to the list of known binding libraries. EDIT: I noticed that my PR comment maaaybe sounds more like an order than the simple description it was intended to be. Sorry! ^^;GitHub
Follow redirects but differently - #curl
daniel.haxx.se/blog/2025/08/06…
In the early days of curl development we (I suppose it was me personally but let's stick with we so that I can pretend the blame is not all on me) made the possibly slightly unwise decision to make the -X option change the HTTP method for all request…daniel.haxx.se
What I'm trying to fix: I have certificates where the issuer DN has accented characters (encoded as utf8 strings) and I'd like curl -v to render these characters properly, instead of showin...GitHub
Hold them for half the normal lifetime. Helps when told to transfer N URLs in quick succession that all use the same non-resolving hostname. Done by storing a DNS entry with a NULL pointer for '...GitHub
c10kday - #curl turns 10,000 days old
daniel.haxx.se/blog/2025/08/05…
From March 20, 1998 when the first curl release was published, to this day August 5, 2025 is exactly 10,000 days. We call it the curl-10000-day. Or just c10kday. c ten K day. We want to celebrate this occasion by collecting and sharing stories.daniel.haxx.se
On August 5 2025, it is exactly 10,000 days since March 20 1998 when the first curl release was done. For this occasion we want to collect fun, exciting, or interesting stories that involve curl an...GitHub
First commit changes this: long val; secs2ms(&val, "1.23456"); // val = 1234 // ok secs2ms(&val, "1.234567"); // val = 1023 // should be 1234 secs2ms(&val, "...GitHub
Makes curl follow redirects an act on the response code and change a custom method accordingly, contrary to --location. Potential future command line to send QUERY and following a redirect accordin...GitHub
Even happier eyeballs
#curl's connection racing goes next level
daniel.haxx.se/blog/2025/08/04…
Back in 2012, the Happy Eyeballs RFC 6555 was published. It details how a sensible Internet client should proceed when connecting to a server.daniel.haxx.se
Ubuntu Server 25.10 removes wget from its default installation, in favour of wcurl, a wrapper included with curl.
omgubuntu.co.uk/2025/08/ubuntu…
Ubuntu Server 25.10 removes wget from its default installation, in favour of the wcurl tool. Here's why the change was made and if it'll affect you.Joey Sneddon (OMG! Ubuntu!)
