[Daniel's week] September 13, 2026

[Daniel Stenberg]

Hello!

Another crazy week ends with me writing this email late in the weekend...

## security

I worked through our inbox on hackerone this week and finally cleared it. No 
pending ones to assess and thirteen confirmed ones. I also assigned CVE IDs 
and wrote up security advisories for all thirteen of them. Then the next wave 
hit and now we again have half a dozen new reports left to assess while a few 
more have been confirmed true vulnerabilities. Seems this coming week might 
look like a repeat of this previous week...

## Rock-solid curl

I made three Rock-solid [1] curl releases early this week and announced them. 
We received one bug about a minor regression in one of them so there might be 
a follow-up release soon. I’m going to wait a little first to see if there 
will be any other issues creeping up.

## performance

The performance tests have been further polished and several contributors have 
stepped forward and helped make curl faster in several ways. This week I 
changed the testing so that it now runs on release code that is built 
optimized. It of course made all the test runs complete much faster and made 
significant bumps in most graphs. An interesting side effect is that now 
several of the HTTP/2 and HTTP/3 performance tests no longer consume 100% CPU, 
presumably because now curl runs faster than the servers...

We have more performance and size reduction improvements coming.

I have previously talked [2] about how I think the Ada URL parser [3] team 
misleads us with their performance numbers shown on their website (which 
claims their parser is 7 times(!) faster than libcurl’s). This week I did a 
quick proof of concept [4] to illustrate how easy we can make a test case that 
shows libcurl’s parser 21% faster than Ada’s.

I’m also working on a tiny URL parser improvement [5] that right now seems to 
run the performance test about 17% faster on my machine while at the same time 
fixing some minor flaws and improving the return codes.

## coming up

- the curl feature window has opened
- I’m speaking at Fastly Xcelerate in Stockholm on Tuesday
- Recording a podcast episode on Thursday

## Links

[1] = https://rock-solid.curl.dev/
[2] = https://daniel.haxx.se/blog/2023/11/21/url-parser-performance/
[3] = https://ada-url.com/
[4] = https://gist.github.com/bagder/b9761d0eeb121a822d9f20d804eb608a
[5] = https://github.com/curl/curl/pull/22924

-- 

  / daniel.haxx.se