#curl

Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years. Yes, found with AI.

I had the joy to chat with @bagder@mastodon.social and @icing@chaos.social about #curl security things We discussed the Summer of Bliss, the influx of LLM vulnerability reports. The stress of dealing with these things, and how much effort all this security work has become They are both amazing people who have a ton of knowledge and experience to share https://opensourcesecurity.io/2026/2026-09-curl-bliss-stefan-daniel/ #OpenSourceSecurity #security #vulnerability

@nlnetlabs@social.nlnetlabs.nl meanwhile, I sit here with at least 20 new curl CVEs in the queue to publish in sync with the next #curl release...

As of two minutes ago, #curl does no longer support SMB. 🎉

Updated chart showing the share of #curl vulnerabilities caused by "C mistakes" as a share of all the vulns we know existed in code over time.

Average number of hours between each #curl vulnerability report, since March 1 2026 (excluding July as we closed during that month): 16.2 During 2025 the average interval was 48 hours ...

Updated #curl September numbers converted into slides for coming talks

Meteorology Current weather in Leonsberg SR SA with magnifico power of wttr.in & le passion grace beauty & colours of lolcat(6) 🏳️‍🌈 wttr curl(1) & {ba{c{k{z{fi}}}}}sh Background photograph is a nice Clouds in FL shades scene meticulously and passionately composed with CIRC_POL 81A FL and UV filters stacked using a Nikon Analog SLR lens combo in my Negative film photography phaselog metalloid@krishna:~/gate/docs $ curl -v wttr.in/leonsberg_suriname|lolcat % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Host wttr.in:80 was resolved. IPv6: (none)IPv4: 5.9.243.187 Trying 5.9.243.187:80...Connected to wttr.in (5.9.243.187) port 80using HTTP/1.x> GET /leonsberg_suriname HTTP/1.1> Host: wttr.in> User-Agent: curl/8.14.1> Accept: /> Request completely sent off< HTTP/1.1 200 OK< Access-Control-Allow-Origin: *< Cache-Control: public, max-age=600< Content-Type: text/plain; charset=utf-8< Date: Fri, 04 Sep 2026 19:27:35 GMT< Transfer-Encoding: chunked< { [8791 bytes data]100 8778 0 8778 0 0 8929 0 --:--:-- --:--:-- --:--:-- 8929 Connection #0 to host wttr.in left intact Weather report: leonsberg_suriname \ / Sunny .-. +34(37) °C ― ( ) ― ↓ 9 km/h `-’ 10 km / \ 0.0 mm Location: Leonsberg, Blauwgrond, Suriname [5.8692506,-55.1026346] Note: Remember to repeat the request with an interval of 8 then 24 secs when the server sends and empty response to curl, watch the LOG! API https://wttr.in https://en.wikipedia.org/wiki/Bash_(Unix_shell) https://gnu.org https://directory.fsf.org/wiki/Bashhttps://curl.se/ https://github.com/busyloop/lolcat Z #Weather #wttr #lolcat #curl #bash #csk #ksh #zsh #sh #fish #meteorology #environment #Physics #Chemistry #Mathematics #Lineair #algebra #technology #OpenSource #programming #POSIX

#curl surpassed 16,000 closed PRs

24 hours to #curl release: 10 CVEs, 6 changes, ~300 bugfixes, 85 contributors, 43 authors, 4 new command line options...

So tell me. Do you think #curl should support plain SSH:// URLs to execute commands remotely? https://github.com/curl/curl/pull/22661

#patreon aggregation thread. Since it basically increased daily viewership by something like 1% by posting one video once to go fishing on Patreon, I'm making adding #lispyGopherClimate #technology #podcast episodes-classic a regular thing over there. The intent is to fish for #lisp ( #curl ?) users over there and bring them into the weekly shows (and #lambdaMOO #VR !) rather than send you over there. Boosts welcome for this thread. @bagder@mastodon.social and @kentpitman@climatejustice.social episode. https://www.patreon.com/screwlisp/posts/interview-daniel-167798555?utm_medium=clipboard_copy&utm_source=copyLink&utm_campaign=postshare_creator&utm_content=join_link

This episode was and is actually really interesting #interview on #AI if I do say so. #curl@bagder@mastodon.social@kentpitman@climatejustice.social https://toobnix.org/w/rPKt4GRBwLeWzF3VcMFWNo

Heads up! In #curl 8.23.0 (end of October 2026) SMB(S) support will be gone. https://github.com/curl/curl/pull/22652

It's now 10 whole years since I tried to do my duty for the community and remove the #curl alias from PowerShell. It's still there. https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/

#curl can download a single transfer HTTP/1.1 (clear-text) 100G file from localhost at 5674473589 bytes/sec on my machine. That's a lot of bytes every second.

We should change #curl 's progress bar to show '3.5" Floppy Discs / second(FLOPS)'. It's just gives a better speed idea.😌

Since they feel so strongly about helping the #curl project I told them to look into https://curl.se/sponsors.html

Welcome to try out #curl 8.22.0-rc1 https://curl.se/rc/ Thanks for flying curl.

It might be time for #curl performance/benchmark testing: https://github.com/curl/curl/discussions/22465