Last year I blogged about the vulnerability reporting process in #curl. It remains the same, just with about 3-4x the volume...
https://daniel.haxx.se/blog/2025/09/18/from-suspicion-to-published-curl-cve/
@bagder.mastodon.social.ap.brid.gy
@bagder.mastodon.social.ap.brid.gyLast year I blogged about the vulnerability reporting process in #curl. It remains the same, just with about 3-4x the volume...
https://daniel.haxx.se/blog/2025/09/18/from-suspicion-to-published-curl-cve/
@bagder.mastodon.social.ap.brid.gyWelcome Paolo Ganci as #curl commit author 1532: https://github.com/curl/curl/pull/22987
@bagder.mastodon.social.ap.brid.gyWelcome Ilias Aberkane as #curl commit author 1531: https://github.com/curl/curl/pull/22980
@bagder.mastodon.social.ap.brid.gyThe pending release date for the next #curl release was just moved two weeks earlier: https://curl.se/mail/lib-2026-09/0009.html
@hugovalters.bsky.socialSend raw binary DNS queries to any DoH endpoint with curl. Build an RFC 8484 wireformat A record payload, POST it with application/dns-message, get the binary https://www.valtersit.com/vault/query-doh-resolver-via-curl-using-wireformat-binary-payload-70d3b0/ #doh #curl #dns
@bagder.mastodon.social.ap.brid.gyWe consider switching to a system where we receive #curl vuln submissions only during a set period of the release cycle. A vuln submission window. Keep it open a few weeks then close it again.
@bagder.mastodon.social.ap.brid.gyFastly reports they see requests with #curl in the user-agent at roughly 7 million requests/sec.
@javimosch.bsky.social🔌 curl-config: CLI tool: curl-config 📦 https://packages.debian.org/curl-config 🔗 https://github.com/javimosch/supercli #curl-config #supercli
@javimosch.bsky.social🔌 curl: curl — command-line tool for transferring data with URL syntax 🔗 https://github.com/javimosch/supercli #curl #supercli
@simonzerafa.infosec.exchange.ap.brid.gy@bagder.mastodon.social.ap.brid.gyto be clear: with #curl you can do any of the TCP based protocols over any of the proxy models we support, or even combine socks proxy + http(s) proxy. Experimentally you can also do HTTP/3 over the http(s) ones.
@bagder.mastodon.social.ap.brid.gyWhen was the last time you used #curl to do telnet over an HTTPS proxy?
@bagder.mastodon.social.ap.brid.gyWelcome Stephen Psaradellis as #curl commit author 1530: https://github.com/curl/curl/pull/22935
@stackflag.bsky.socialCVE-2026-8924 - curl
The curl command-line tool on Debian 13 and related packages can be fooled into running harmful code if it processes a specially crafted web address. This puts any system…
Too many irrelevant or confusing CVEs? Use stackflag.com
@bagder.mastodon.social.ap.brid.gyAs of two minutes ago, #curl does no longer support SMB. 🎉
@stackflag.bsky.socialCVE-2026-8926 - curl
Curl incorrectly retrieves passwords from .netrc files when a username is specified in the URL. This can expose passwords for the wrong user if multiple users are configured for…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-9079 - curl
libcurl, a software used for internet transfers, has a flaw that can expose old proxy passwords. This is a concern because it allows unauthorized access to proxy servers. To…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-8927 - curl
When using libcurl to transfer data through multiple proxies, sensitive authentication information may be accidentally shared between transfers. This can happen when the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-10536 - curl
A security issue exists in libcurl's HTTP/2 feature when resetting a connection. If an application uses this feature and then closes the connection, sensitive data may be…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-11856 - curl
A bug in libcurl can cause it to accidentally send passwords meant for one website to another. This can happen if you use libcurl to log in to a website with a password, and…
Too many irrelevant or confusing CVEs? Use stackflag.com