curl started out GPL licensed, as direct inheritance from its httpget days, but in October 1998 we switched to the Mozilla Public License (MPL). In 2001, we added the MIT license as an additional license to optionally use in addition to MPL. We made curl dual licensed because clearly the MPL license caused problems...

Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source code. This has resulted in no less than thirty-five published curl vulnerabilities and CVE Ids. Today, we make Aisle’s audit report available on the curl website. Yet...

In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free. This post explains the bug, what the problem can lead to, and something about why it happened and what we have...

Release presentation At 08:00 UTC (10:00 CEST) of the release day, as the tradition dictates, I do a live-streamed release presentation on Twitch. Made available on YouTube after Numbers the 277th release4 changes42 days (total: 10,929)281 bugfixes (total: 14,770)476 commits (total: 40,084)0 new public libcurl...

Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of the initial outcomes. When the team gets a new set of charts, graphs and plots that visualize something, like performance, they offer an excellent opportunity for us to...

The curl security team happens to also double as the curl core team. The small group of people who assess security reports and take project decisions. The exact set of participants in this team of course vary over time, as this is a volunteer membership role without monetary compensation. I decided to write this...

On October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of the next release as the best version we ever did – and this time is no exception. Decades of collected experiences and meticulous polishing has lead us to this....

Exactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS. Exactly twenty-five years ago today. Within all their fancy release presentations and videos there are barely no mentions of curl. In their technical notes page, there is just...

Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation At 10:00 CEST (08:00 UTC) Daniel makes a live-streamed release presentation on Twich....

This afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it. Their vulnerability scanner identified it as vulnerable to several publicly known vulnerabilities. Can we bump it to...

tldr: the live version is here: https://curl.se/perf/ How fast is “fast” and is it good enough? Does it run as fast now as it did before or was there a regression? What exactly needs to be fast? How fast is it? These are questions that many projects and products face, and in curl we are no different. Yet,...

At this exact moment curl’s summer of bliss 2026 ends. We (the maintainers of curl) took the entire month of July off from vulnerability reporting and in this post I will try to explain how this went. (If you feel like skipping the wordy blab below, the single word answer is: fine) This was possibly our best project...