The Pulse
AISLE Finds 18 curl Vulnerabilities in Latest Audit
AISLE says its curl security audit found 24 vulnerabilities across two releases, with 18 fixed in curl 8.23.0 on October 14, 2026. The flaws include credential leaks, redirect and connection-reuse errors, and mishandled cookies and HTTP sta
AI.info Team · Written with AI ·
Anthropic’s Mythos, OpenAI’s Codex Security and ZeroPath found no further curl vulnerabilities in an earlier review, AISLE says. The AI security company’s subsequent audit identified 24 CVEs across two curl releases, including 18 fixed in curl 8.23.0, released October 14, 2026. The figures describe separate reviews, not a shared benchmark: AISLE’s account does not give a common test protocol for comparing the systems.
Twenty-four CVEs across two releases
AISLE says six of its findings were fixed in curl 8.22.0, released September 2, and 18 more are included in 8.23.0. The company describes the work as a dedicated audit requested by curl founder Daniel Stenberg after a year of collaboration. It says its 12-month work on curl has produced 35 CVEs and 160 additional bug fixes; those totals are AISLE’s accounting.
The vulnerabilities span more than one type of bug. Several concern credentials or authenticated connections crossing trust boundaries: one flaw could send Negotiate credentials to a redirected origin, while another involved a redirected SFTP or SCP connection that proceeded without requested SSH host verification. Project curl’s advisory says the latter affects the command-line tool, not libcurl, and calls allowing redirects to SFTP or SCP rare.
State changes created the harder cases
Other findings involve persistent or protocol state. AISLE lists flaws that could erase a cookie jar or mishandle HSTS entries, alongside an IMAP command-injection issue and a weakness in curl’s -J no-clobber protection. Project curl says the -J flaw could let a server overwrite an existing local file when an intermediate HTTP 103 Early Hints response arrives; the advisory rates it low severity.
AISLE argues that these problems were difficult to catch because they emerge through sequences of events rather than one obviously unsafe line of code. A redirect can change a destination while credentials remain attached to a connection; a pooled connection can be reused under a different identity; or a cookie can be accepted and later mishandled when saved. The company says its process builds code context, traces state across components, tests candidate findings, and has a human security researcher review reports before submission.
curl maintainers reviewed the reports
AISLE’s account says the curl security team independently decides whether reported behavior violates the project’s security policy, how serious it is, and whether it merits a CVE. Stenberg’s account of the collaboration praises the findings’ detail and the human work supporting them.
“Their vast amount of detailed and accurate findings backed up by a team of skilled humans have made it possible for us to identify and fix more vulnerabilities in curl at a higher rate than ever before, leading to the billions of mostly indirect daily curl users to be more secure.”
Daniel Stenberg, founder and lead developer of the curl project, writing on his blog
Upgrade to curl 8.23.0
AISLE recommends upgrading to curl 8.23.0 or applying relevant fixes to supported branches. Project curl’s release history lists 8.23.0 as released on October 14. Some advisories distinguish between the curl command-line program and libcurl, the library embedded in other software, so administrators should check which component and version their systems use.