@bagder the complexity of exploiting this seems like HIGH is still being generous. Very nice read nonetheless.
#curl
@bryan.dusty.ninja.ap.brid.gy
@bryan.dusty.ninja.ap.brid.gy
@bagder.mastodon.social.ap.brid.gyThe #curl release presentation is live-streamed and the stream is.... up!
@bagder.mastodon.social.ap.brid.gyThe full vulnerability report for the nasty #curl UAF problem is disclosed. It was submitted by people at Anthropic. The reproducer is a minor piece of art.
@dk3jf.radiosocial.de.ap.brid.gy@bagder.mastodon.social.ap.brid.gyA UAF turned RCE
In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.
@bagder.mastodon.social.ap.brid.gy@bagder.mastodon.social.ap.brid.gyless than 24 hours to the #curl release
24 vulnerabilities fixed and corresponding CVE Ids will be announced
4 minor changes
280 bugfixes
by 83 contributors and 45 commit authors
in 42 days since the previous release...
@bagder.mastodon.social.ap.brid.gyWelcome Daniel Wade as #curl commit author 1546: https://github.com/curl/curl/pull/23344
@bagder.mastodon.social.ap.brid.gyA slightly faster slimmer #curl
https://daniel.haxx.se/blog/2026/10/13/a-slightly-faster-slimmer-curl/
@bagder.mastodon.social.ap.brid.gyIf you have a libcurl stand-alone example less than 250 lines in C, ideally using one of the many options the existing examples don't use, feel encouraged to submit it to the #curl project.
The 130 existing examples are here:
@threadlinqs.bsky.socialGoogle DevSite's OAuth secret was also its Flask signing key - forged cookies led to pickle RCE. https://intel.threadlinqs.com/threat/TL-2026-3355 #ThreatIntel #Python #pickletoolsdis #curl
@bagder.mastodon.social.ap.brid.gyThe 2026 #curl team
Max, Stefan, Dan, James, Viktor and me.
@bagder.mastodon.social.ap.brid.gyWelcome jdymitarai as #curl commit author 1545: https://github.com/curl/curl/pull/23363
@bagder.mastodon.social.ap.brid.gyI just want to express my gratitude and thanks to Daniel Gustafsson for all the time and efforts spent on #curl over the years.
Daniel has decided to step down from the curl security team and has asked to get his "commit bit" revoked.
Thanks Daniel, you are always welcome back when you feel […]
@bagder.mastodon.social.ap.brid.gyCome Wednesday, CVE-2026-92392 is the #curl CVE everyone will think either was blown out of proportions or was underestimated or something else. That happened the last time we reported a HIGH severity issue and I expect it to happen again.
libcurl is a rather generic LIBRARY - it is used in […]
@bagder.mastodon.social.ap.brid.gythe worst #curl version ever released is curl 7.46.0 (Dec 2015), which after October 14 has a whopping 107 known vulnerabilities...
@bagder.mastodon.social.ap.brid.gyNumber of published #curl vulnerabilities on October 14 and the 2026 projection.
@linuxteck.bsky.socialcurl vs wget: Which Is Better for Downloading Files?
Two useful Linux tools, two different strengths. 🐧
www.linuxteck.com/curl-vs-wget/
Explore the differences and practical examples:
@threadlinqs.bsky.socialTalos: AI agent swarms are noisy pentesters today, but could soon learn to hide and persist like red teams. https://intel.threadlinqs.com/threat/TL-2026-3163 #ThreatIntel #python #curl #wget
@yuliasilvae.bsky.social