I write curl. I don't know anything.
🌉 bridged from ⁂ https://mastodon.social/@bagder, follow @ap.brid.gy to interact
daniel:// stenberg://
Loading...
Including the pending #curl CVEs, the top-20 most long-standing vulnerabilities ever found in curl are *all* older than 20 years. The oldest over 25 years.
daniel:// stenberg://
Out of the 16 pending #curl CVEs:
13 are severity LOW
3 are severity MEDIUM
9 of them are libcurl only (not the tool)
3 are "C mistakes"
2 are younger than six months old
1 is older than 25 years
daniel:// stenberg://
and there are 500+ hours left to next release...
daniel:// stenberg://
Since March 1st 2026, we have received 143 vulnerability reports to the #curl project. One new every 17 hours.
Since March 1st 2026, we have received 143 vulnerability reports to the #curl project. One new every 17 hours.
Welcome A Johnston as #curl commit author 1485: https://github.com/curl/curl/pull/21809
daniel:// stenberg://
daniel:// stenberg://
Since the latest #curl release, we have received one confirmed vulnerability every 59th hour on average.
daniel:// stenberg://
#curl 8.21.0-rc2 is up at https://curl.se/rc/
Take it for a spin. Report any issues. Thanks for flying curl.
daniel:// stenberg://
A human in control. In #curl development.
https://daniel.haxx.se/blog/2026/06/10/a-human-in-control/