[Daniel's week] September 5, 2026

[Daniel Stenberg]

Hello!

It did not strike me until several days into this week that I actually forgot 
to send my weekly email last week. I was that preoccupied. Never mind, here’s 
a new week and things happened!

## release

curl 8.22.0 [3] shipped with 10 CVE announcements [4], 6 changes and 300+ 
bugfixes. The days following a release we are always waiting nervously to 
learn if there was some ugly regression this time that would force us to do a 
patch release. When I write this, we still have not seen any such and it feels 
great. Our release candidates really work well in this regard!

## security

A few days before this release we had to hit pause on our vulnerability 
reporting assessments so that we could get some calm and order to do 
everything right when we ship a new version. Now, once that is out the door we 
are returning back to plow through the extensive queue of issues we have to 
work with. We already know that some of these are true vulnerabilities so 
there will definitely be more such to announce in sync with the pending next 
release. The majority of these issues have been submitted by our friends at 
Aisle [5].

## performance

The performance testing graphs [2] have continued to be a real success and we 
have now jointly shrunk all measure struct sizes, we have improved HTTP/3 
upload performance (2x) and memory consumption (1/10) significantly, URL 
encoding/decoding got massively faster (5x), URL parsing is faster (10%) and 
even snprintf() has seen improvements (5%). The perf site itself has also been 
improved a little to manage the growing data.

## rock-solid curl

I’m happy to say that this coming week I will announce three Rock-solid curl 
[1] releases: three old curl release branches with a full set of backported 
vulnerability fixes applied (that’s a total of over one hundred patches 
applied). Stay tuned for the announcements. The Rock-solid curl releases are 
available behind a paywall. Get in touch if you want to join the Rock-solid 
curl fun.

## coming up

- another week of cooling off period before the curl feature window opens
- I’m doing an online talk and Q&A Thursday on AI findings in Open Source

## Links

[1] = https://rock-solid.curl.dev/
[2] = https://curl.se/perf/
[3] = https://daniel.haxx.se/blog/2026/09/02/curl-8-22-0/
[4] = https://curl.se/docs/security.html
[5] = https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero

-- 

  / daniel.haxx.se