We’re at 24 received #curl vulnerability reports received since yday morning…
curl
Follow from the Fediverse
Follow #curl from Mastodon or any other Fediverse app and its public posts arrive in your timeline. No vutuv account needed.
@curl@tags.vutuv.de
Posts with this tag
58 posts
Filters
Sunday morning #curl HackerOne status: 13 reports waiting assessment and triage. Still at 11 confirmed vulns.
One confirmed #curl vulnerability reported every 14th hour since the previous release.
#curl’s law: Everything eventually runs curl
A trend in society over the last decade and I don’t see it changing anytime soon.
Hello #HackerOne.
We are deeply disappointed that you have started to require ID verification from hackers who want to submit vulnerability reports to #curl, as this now makes them turn away and we miss out on their reports.
We have not been a bug bounty program since February and we do not intend to go back to bounties. What do we need to do for you to switch us to “just” a Vulnerability Disclosure Program so that you can stop requiring ID from security researchers trying to help us out?
I will monitor the situation, but if no credible team replacement steps up, we need to consider deprecating mbedtls support in #curl later in 2027.
Just 36 hours after the previous #curl release, we are already at three pending CVE announcements queued up… 😰
#curl, wenn Milliarden Geräte ein Programm nutzen. 😊
Die Industrie wird wahrscheinlich wieder viele Monate benötigen um curl zu aktualisieren. Da haben es die Open-Source-Fans bedeutend leichter. 👍
Bei Geräten die eine #Firmware nutzen, kann es vielleicht sogar “nie” ein Update geben. Hängt von den Möglichkeiten und dem Cyber Resilience Act (CRA) ab - ob die Behörden ihn durchsetzen können oder wollen.
Hat #KI was damit zu tun?
“Daniel Stenberg ist zudem ein profilierter Vordenker der Szene; er sprach und schrieb in der Vergangenheit häufig über Sinn und Unsinn von KI. Im Juli pausierte sein Projekt gar die Annahme von Fehler-Reports und nannte das „Sommer der Glückseligkeit“.”
Welche Version ist aktuell?
cURL 8.23.0
Ein erfahrener Spezialist oder guter #MSP kann seinen Kunden sicher helfen und zeitnah Updates einspielen. 🙂
KI
curl
There are in fact #curl stickers available at the #OpenSSL conference. Come to the registration desk to get yours!
OpenSSLCon26
#curl 8.23.0 with Daniel Stenberg
The #curl release presentation is live-streamed and the stream is…. up!
The full vulnerability report for the nasty #curl UAF problem is disclosed. It was submitted by people at Anthropic. The reproducer is a minor piece of art.
A UAF turned RCE
In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.
less than 24 hours to the #curl release
24 vulnerabilities fixed and corresponding CVE Ids will be announced
4 minor changes
280 bugfixes
by 83 contributors and 45 commit authors
in 42 days since the previous release…
