Grrrrr. We are now looking at *three* vulnerabilities to announce with the next #curl release...
06.03.2026 13:34
👍 6
🔁 1
💬 3
📌 0
Grrrrr. We are now looking at *three* vulnerabilities to announce with the next #curl release...
After conference beer in Oslo with the Mrs. Living the open source celeb life. Not bad.
I'll talk three decades of #curl in less than an hour here at NDC Security:
https://ndcsecurity.com/agenda/three-decades-of-curl-0ugm/0m55j1o34kp
My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."
Hello #Oslo
The Open Infra meetup on May 21 in Stockholm is open for registration.
I'll chip in with a light-weight blab I call "State actors, sleeper agents and plain bugs. Curl security matters."
https://www.meetup.com/openinfra-user-group-sweden/events/313615139/
and now I'm about to drop all uses of "just"... https://github.com/curl/curl/pull/20793
I can tell you that this bites me just about every time I write more than two sentences. Then I go back, edit and push fixup commit and hope that I learned something. Again.
a detail you probably didn't know: no where in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.
@ssg @shanselman thanks, I tend to miss the replies to the mirror-me over there...
but I took it to the big generic security portal and submitted a report there. Let's see what happens.
"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities […]
On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
https://curl.se/mail/archive-2026-03/0000.html
We are nine days away from the pending #curl release, with 212 bugfixes merged and one pending CVE announcement.
just noticed I'm mentioned on the AI slop wikipedia page: https://en.wikipedia.org/wiki/AI_slop
IRC made me to make curl
https://youtu.be/ohzzGy5K9Dk?si=YH1JcSQ7z6-YlktW
Learn to curl 2-hour Intro Lesson poster with a picture of a curling stone
Ah, nice! A local teacher providing lessons on how to make HTTP requests from the command line! 😃
Er, hmm…maybe that's not it actually. Sorry @bagder, I think I got too excited there for a minute! 😅
@skaverat @HisVirusness he knew how curl took off sure. His contributions I believe stopped maybe already in 1997
@HisVirusness unfortunately he is no longer with us. He died almost ten years ago.
IRC made me to make curl
https://youtu.be/ohzzGy5K9Dk?si=YH1JcSQ7z6-YlktW
then of course, I added code to the what would become the curl project already in late 1996 and I am still working on it, while Wget maintainers have been replaced several times since those early days.
Wget had its initial release (under a different name) in January 1996, so it has now already surpassed its 30th birthday.
curl is way behind, as it did not start its journey (under a different name) until November 11 1996
Welcome Florian Imdahl as #curl commit author 1447: https://github.com/curl/curl/pull/20748
Three decades of curl. March 5, 2026. Daniel Stenberg. NDC Security
My week: https://lists.haxx.se/pipermail/daniel/2026-February/000147.html
vacation, security, distro meeting, curl up, NDC Security, rc, lagging, rock-solid, decomplexification, netstack, user survey, foss-north
The third and final release candidate for #curl 8.19.0 is now available at
https://curl.se/rc/
@codecat insanely so
curl.se over the last 30 days:
Served 77.12 TB of data at 3.81k requests/second.
95.91% of the object sizes were <1KB.
0.01% of the downloaded object sizes were 1-10MB (a tarball download)
99.69% of the content delivered was cached by the CDN.
Thanks #Fastly!
