[Daniel's week] August 8, 2026

[Daniel Stenberg]

Hi!

Another week and here's some things I worked on:

# August 7, 2026

## security

We opened up for receiving curl vulnerability reports on Hackerone again on 
Monday. It only took 30 minutes for the first report to arrive but it turned 
out that the avalanche we feared would come because we have had the intake 
closed for a whole month did not happen.

As I write this, we have received seven reports this week out of which one is 
a confirmed new vulnerability with low severity. It means that we now have two 
pending CVE announcements to do together with the next curl release. With 
almost a month left, I’m convinced there will be at least a few more by then.

I also published a blog post about the summer of bliss [1].

## menu

The website menu work I mentioned last week was merged and now the site is a 
tad bit more accessible I think [2]. There are only minor visual differences 
so most people won’t notice...

I also took the opportunity to follow-up and introduce a “security” top-level 
menu option in the docs section of the site [3] to make it easier to find and 
maneuver to that information.

## localhost connect

Marcel Jamin contacted us on the libcurl mailing list and proposed a way to 
fix the problem I blogged about two years ago [4]: Windows is really slow to 
detect TCP connect problems for localhost. I took his proposed solution and 
massaged it into something that ran green in CI [5] (without being able to 
build or test it myself locally as I have no Windows machines).

Marcel also reported the problem and fix to Chrome[7] and then merged their 
corresponding version [8] as well, even with a link to my blog post in a 
comment in the source code.

I then asked Valentin and Max on the Firefox networking team if they already 
have this fix or not, which led to them creating a bugzilla entry about it 
[9].

## typos

We have two spellcheck CI jobs that both also scan source code and 
occasionally they drive me in how they complain about source code that is 
perfectly fine but might use a variable that looks like a misspelled English 
word. At one point a few months ago when I yet again got sad about such a 
complaint, I started writing a tool that scans a C source code file, blanks 
out all code and just keeps all comments and strings in the output. The idea 
would be that those are the parts that we primarily want spellchecked anyway, 
and neither of the tools offered that feature.

This week after I saw Stefan get upset about some new false positives and I 
too experienced some, I went back to my tool [10], polished it a little bit 
more and I have a proposed PR [11] that changes the spellcheck CI jobs to only 
check strings and comments.

## Server Push

I made a call on the libcurl mailing list [12] and on Mastodon if there are 
any users out there who are using HTTP/2 Server Push with libcurl. Not a 
single person has responded saying they do, and now we have put that feature 
up for deprecation [13] and removal from curl in 2027.

## 26 years

On August 7 2000 the first ever libcurl was released as part of the curl 7.1 
release [6].

## Coming up

- The curl feature window closes today
- curl 8.22.0-rc1 ships today

## Links

[1] = https://daniel.haxx.se/blog/2026/08/03/what-the-bliss-taught-us/
[2] = https://curl.se/
[3] = https://curl.se/docs/
[4] = https://daniel.haxx.se/blog/2024/08/14/slow-tcp-connect-on-windows/
[5] = https://github.com/curl/curl/pull/22494
[6] = https://curl.se/ch/7.1.html
[7] = https://issues.chromium.org/issues/542261173
[8] = https://chromium-review.googlesource.com/c/chromium/src/+/8212039/5/net/socket/tcp_socket_win.cc
[9] = https://bugzilla.mozilla.org/show_bug.cgi?id=2061349
[10] = https://github.com/bagder/c-comments
[11] = https://github.com/curl/curl/pull/22509
[12] = https://curl.se/mail/lib-2026-08/0003.html
[13] = https://curl.se/dev/deprecate.html#http2-server-push

-- 

  / daniel.haxx.se