#curl

For some reason the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is far more wider issue. Brotli compression is supported by many client side applications processing HTTP responses. While some of them have sandboxes and quick update cycle (read: web browsers), many don't. In particular many devices and applications using #curl / libcurl are affected and must be updated ASAP.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #cybersecurity #CVE_2026_111497

Welcome Michiel van Slobbe as #curl commit author 1560. Making WebSocket transfers much faster in: https://github.com/curl/curl/pull/23567

on Monday I will create 13 new pull-requests with the pending Security Advisories for coming #curl CVEs with severity LOW or MEDIUM. Then our new policy takes effect and a lot less vulnerability work in curl will be done in private, and almost all of it will go public. You are all invited to help out.

@bagder and curl on stage at tech Borås! 😊

#curl #boras

feel free to contrib https://opencollective.com/curl#category-CONTRIBUTE ... its real annoying right now #curl

#curl 8.23.0_3 update released at https://curl.se/windows/. It no longer ships with a CA bundle. Since 8.19.0 (2026-03-11) curl and libcurl are using the native Windows CA roots by default. I kept including the CA bundle to serve as a manual fallback, in case the native CA fails. This option remains, but the bundle needs to be downloaded separately. If you use an official curl release older than this, consider upgrading to 8.19.0+, or refresh the CA bundle to avoid the compromised eMudhra certs.

Out of all #curl CVEs we have registered since 2019, 41% have been registered in 2026

We started the #curl hackerone program in April 2019. We have received 1,030 vulnerability reports over these 7.5 years.

More than a third of the reports were submitted in 2026.

Do minor #curl vulnerabilities in the open

(Starting Monday October 26)

https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/

#curl hackerone stats as of yday

At our #curl maintainer meeting tonight we decided to move forward with the "handle LOW/MED vuln reports openly on GitHub".

Now we just need to get the documentation and processes adjusted, then push the button to do this. Maybe write a blog post too. So, ideally within this week.

Stay tuned

At 32 #curl vulnerability submissions since Saturday morning.

All of them are MUCH too long without explaining the problem up front in a few human written sentences. Most of them identify a problem. Many of them overstate the problem. Many of them claim a vulnerability when its just a minor bug.

Four years ago, the #curl project was part of the Sovereign Tech Fund's pilot program and we improved #curl a bit: https://daniel.haxx.se/blog/2022/10/19/funded-curl-improvements/

Welcome Jeremy Levartovsky as #curl commit author 1553: https://github.com/curl/curl/pull/23469

Welcome Martin Mirchev as #curl commit author 1552: https://github.com/curl/curl/pull/23472

We're at 24 received #curl vulnerability reports received since yday morning...

Sunday morning #curl HackerOne status: 13 reports waiting assessment and triage. Still at 11 confirmed vulns.

In computer science, this would be regarded as s flow control problem. The solution: limit your inbox window, drop incoming data beyond that.

This #curl did during its Summer of Bliss 2026.

BUT: this is not allowed in the CVE system.

So, everyone look away while we did this, requiring us to immediately start working should something really bad prop up. Or else.

The simple observation:

The #curl project is getting DoS‘ed by security researchers.

No mal intent, but driven by stock/work market evaluations.

Example: Aisle has shown its value by the curl CVEs claimed and was now bought by Cohere, presumably a good deal for both companies.

Economically reasonable behaviour for both. The FOSS projects are the roadkill, though.

All reporters have similar motivations, down to individuals improving their personal market value.

Welcome Máté Szabó as #curl commit author 1549: https://github.com/curl/curl/pull/23444

One confirmed #curl vulnerability reported every 14th hour since the previous release.

#curl's law: Everything eventually runs curl

A trend in society over the last decade and I don't see it changing anytime soon.

Hello #HackerOne.

We are deeply disappointed that you have started to require ID verification from hackers who want to submit vulnerability reports to #curl, as this now makes them turn away and we miss out on their reports.

We have not been a bug bounty program since February and we do not intend to go back to bounties. What do we need to do for you to switch us to "just" a Vulnerability Disclosure Program so that you can stop requiring ID from security researchers trying to help us out?

I will monitor the situation, but if no credible team replacement steps up, we need to consider deprecating mbedtls support in #curl later in 2027.

OSI approved the #curl license

https://daniel.haxx.se/blog/2026/10/15/osi-approved-the-curl-license/

Just 36 hours after the previous #curl release, we are already at three pending CVE announcements queued up... 😰

Welcome pszemus as #curl commit author 1548: https://github.com/curl/curl/pull/23408

A #curl audit by Aisle

https://daniel.haxx.se/blog/2026/10/14/a-curl-audit-by-aisle/

#curl 8.23.0 with Daniel Stenberg

https://youtu.be/hQ5xZ-vO8Pg