[Daniel's week] October 16, 2026

[Daniel Stenberg]

# October 16, 2026

Hello friends. Another packed weeks ends.

## release

I put together and uploaded the curl 8.23.0 release [5]. We published 24(!) 
vulnerabilities and CVEs in association with this. I did the ordinary release 
video presentation and then proceeded and did three Rock-solid curl releases: 
release three different versions from older branches with all known 
vulnerabilities addressed. This time around that worked summed up to 55 
separate patches. All this in a shorter release cycle than normal as it had 
only been six weeks since the last release as compared to our normal eight 
weeks...

This release is the first that features Daisy the cat in the release photo 
[5], which of course made it a better release than usual.

## security

I posted a dedicated article [4] explaining a little about the Use-After-Free 
bug we fixed that has been proved can be turned into a full 
Remote-Code-Execution problem, even if that requires a long series of bad luck 
for that to work out. So far I have seen surprisingly little feedback and 
comments on the issue. I expected half of the audience to think it was 
overstated and the other half to claim it was underrated. Instead we got 
mostly silence; which I think is good.

We published a curl audit report from Aisle, detailing their work and their 
findings in curl over the last year [3].

We paused our work on pending issues on HackerOne for a few days before the 
release happened - to get some peace and quiet in order to put everything 
together - but now we have resumed and started to work on the reports in the 
inbox again and as I write this we have another five confirmed vulnerabilities 
to work with...

Clearly this wave of vulnerability reports is not over.

## the team

When Daniel Gustafsson announced that he stepped down [8] from the security 
team it reminded me to celebrate my team mates there better, and I wrote a 
separate blog post explaining who they are [7].

## mbedtls

MbedTLS announced: “The existing maintainers will cease their involvement in 
their development and maintenance of Mbed TLS from April 2027.” [1]

Maintaining a TLS library is a lot of work and it takes a skilled and 
dedicated team to do it well. It feels unlikely that a new one will just 
appear by spring next year, and if that does not happen we might have to 
consider dropping support for this by the summer of 27.  We will simply 
monitor the situation and see what happens.

## license

I happened to realize that the curl license has been acknowledged as an Open 
Source license by the Open Source Initiative [2].

## scorecard

We reintroduced the OpenSSL scorecard [9] on curl’s GitHub as I noticed the 
big splash about their latest release. This time it scores curl 9.0 out of 10, 
compared to the last time four years ago when it gave us 6.2. We submitted 
some bug reports upstream and there are still some question marks around what 
exactly is missing to reach 10, but I won’t bother pushing it at this time. I 
have bigger fish to fry.

## coming up

- Saturday: doing an online “fireside chat” with Purdue University
- Wednesday: I speak at Borås Tech day, in Borås Sweden

## Links

[1] = https://lists.trustedfirmware.org/archives/list/mbed-tls@lists.trustedfirmware.org/thread/YPIGCB7WN6GCHOGEGKOJXUYAP7OK527W/#BSRM3JY6JFNWWEHKMY4JQQON5QB3LP5U
[2] = https://daniel.haxx.se/blog/2026/10/15/osi-approved-the-curl-license/
[3] = https://daniel.haxx.se/blog/2026/10/14/a-curl-audit-by-aisle/
[4] = https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/
[5] = https://daniel.haxx.se/blog/2026/10/14/curl-8-23-0/
[6] = https://daniel.haxx.se/blog/2026/10/13/a-slightly-faster-slimmer-curl/
[7] = https://daniel.haxx.se/blog/2026/10/12/the-2026-curl-team/
[8] = https://curl.se/mail/lib-2026-10/0001.html
[9] = https://scorecard.dev/


-- 

  / daniel.haxx.se