[Daniel's week] September 18, 2026

[Daniel Stenberg]

Hi friends!

## security

Another intense week of primarily work with vulnerability reports for me. The 
queue now says twenty pending CVEs to announce and we decided this week to 
shorten this release cycle by two weeks so that we can get these out earlier 
than previously planned.

This means the new release date for curl 8.23.0 is set to October 14 and we 
closed the feature window immediately to keep everything orderly.

We will of course deal with all coming vulnerability reports that arrive 
before then as well to the extent we are able to. I expect there to be some.

I had a look at the “project number of CVEs” that we estimated back at curl up 
in late May. We then said it could end up at 55 by the end of the year. As we 
now already have published 45 and there are (at least) 20 coming, we have 
certainly exceeded those projections. The question is now rather if it will 
even be below 80 by the end of the year.

## performance

Trying to squeeze some more performance is a good distraction from the 
vulnerability reports and this week I made a new performance test for the date 
parser. More specifically for the functions that lookup day of the week names, 
month names and time zone names. The date parser is called for several 
features, including most incoming cookies so it makes sense to have it as fast 
as possible.

The perf site [1] shows the updated date parser function to run twice as fast 
as before.

Next up: number parsing.

## events

I spoke at Fastly Xcelerate in Stockholm on Tuesday about AI vulnerability 
findings. I also participated in an interview with a Swedish tech journalist 
there together with Artur, one of the Fastly founders. Stefan Eissing and I 
guested Josh Bresser’s Open Source Security podcast [2] on Thursday and talked 
curl development, summer of bliss and of course the vulnerability report 
deluge.

## coming up

- another podcast recording on Tuesday
- Rock-solid curl webinar on Thursday, stay tuned for details

## Links

[1] = https://curl.se/perf/
[2] = https://opensourcesecurity.io/

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev