daniel.haxx.se

Lots of people who are against the use of AI for all its ethical and inherent issues tell me this.

The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues…

curl started out GPL licensed, as direct inheritance from its httpget days, but in October 1998 we switched to the Mozilla Public License (MPL).

Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source code.

In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time.

Release presentation Numbers the 277th release 4 changes 42 days (total: 10,929) 281 bugfixes (total: 14,770) 476 commits (total: 40,084) 0 new public libcurl function (total: 100) 0 new curl_easy_setopt() option (total: 312) 0 new curl command line option

Back in August I mentioned the new curl performance tests we have running.

The curl security team happens to also double as the curl core team.

On October 14 2026 we will ship curl 8.23.0.

Exactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system.

Welcome to this new release.

This afternoon I had a meeting with IT people at a huge US power infrastructure company.

tldr: the live version is here: https://curl.se/perf/ How fast is “fast” and is it good enough?

At this exact moment curl’s summer of bliss 2026 ends.

The recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them.

It takes a village to make curl.

See also: day one, day two.

If you missed it.

On this hot summer’s day in Basel, Switzerland, the seventh HTTP workshop started.

Over the years, we have received, read and handled way over one thousand vulnerability reports filed against curl.