[Daniel's week] October 16, 2026
# October 16, 2026
Hello friends. Another packed weeks ends.
## release
I put together and uploaded the curl 8.23.0 release [5]. We published 24(!) vulnerabilities and CVEs in association with this. I did the ordinary release video presentation and then proceeded and did three Rock-solid curl releases: release three different versions from older branches with all known vulnerabilities addressed. This time around that worked summed up to 55 separate patches. All this in a shorter release cycle than normal as it had only been six weeks since the last release as compared to our normal eight weeks...
This release is the first that features Daisy the cat in the release photo [5], which of course made it a better release than usual.
## security
I posted a dedicated article [4] explaining a little about the Use-After-Free bug we fixed that has been proved can be turned into a full Remote-Code-Execution problem, even if that requires a long series of bad luck for that to work out. So far I have seen surprisingly little feedback and comments on the issue. I expected half of the audience to think it was overstated and the other half to claim it was underrated. Instead we got mostly silence; which I think is good.
We published a curl audit report from Aisle, detailing their work and their findings in curl over the last year [3].
We paused our work on pending issues on HackerOne for a few days before the release happened - to get some peace and quiet in order to put everything together - but now we have resumed and started to work on the reports in the inbox again and as I write this we have another five confirmed vulnerabilities to work with...
Clearly this wave of vulnerability reports is not over.
## the team
When Daniel Gustafsson announced that he stepped down [8] from the security team it reminded me to celebrate my team mates there better, and I wrote a separate blog post explaining who they are [7].
## mbedtls
MbedTLS announced: “The existing maintainers will cease their involvement in their development and maintenance of Mbed TLS from April 2027.” [1]
Maintaining a TLS library is a lot of work and it takes a skilled and dedicated team to do it well. It feels unlikely that a new one will just appear by spring next year, and if that does not happen we might have to consider dropping support for this by the summer of 27. We will simply monitor the situation and see what happens.
## license
I happened to realize that the curl license has been acknowledged as an Open Source license by the Open Source Initiative [2].
## scorecard
We reintroduced the OpenSSL scorecard [9] on curl’s GitHub as I noticed the big splash about their latest release. This time it scores curl 9.0 out of 10, compared to the last time four years ago when it gave us 6.2. We submitted some bug reports upstream and there are still some question marks around what exactly is missing to reach 10, but I won’t bother pushing it at this time. I have bigger fish to fry.
## coming up
- Saturday: doing an online “fireside chat” with Purdue University
- Wednesday: I speak at Borås Tech day, in Borås Sweden
## Links
[1] = https://lists.trustedfirmware.org/archives/list/[email protected]/thread/YPIGCB7WN6GCHOGEGKOJXUYAP7OK527W/#BSRM3JY6JFNWWEHKMY4JQQON5QB3LP5U [2] = https://daniel.haxx.se/blog/2026/10/15/osi-approved-the-curl-license/ [3] = https://daniel.haxx.se/blog/2026/10/14/a-curl-audit-by-aisle/ [4] = https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/ [5] = https://daniel.haxx.se/blog/2026/10/14/curl-8-23-0/ [6] = https://daniel.haxx.se/blog/2026/10/13/a-slightly-faster-slimmer-curl/ [7] = https://daniel.haxx.se/blog/2026/10/12/the-2026-curl-team/ [8] = https://curl.se/mail/lib-2026-10/0001.html [9] = https://scorecard.dev/
--
/ daniel.haxx.se
--
Daniel's weekly mails https://lists.haxx.se/listinfo/daniel