curl
curl is an open-source command-line tool and network transfer library that supports data transfer over dozens of network protocols, including HTTP, HTTPS, FTP, and SMTP. It is widely used for sending network requests, uploading and downloading files, and debugging APIs. It provides cross-platform support, and its underlying library, libcurl, can be called by multiple programming languages and applications, making it a foundational tool in network development and operations.
Timeline (last 90 days)
curl is an open-source project initiated by Daniel Stenberg in 1996, and its name means Client URL, relying on the libcurl library to make network requests.
Fancy Curl Sites is a project that renders the content returned by curl requests into readable, interactive pages, enabling the terminal to present a visual effect close to that of a browser.
The difference between Fancy Curl Sites and text browsers is that it directly reuses curl's request pipeline, requires no additional installation of browser-level binaries, and lowers distribution and onboarding costs.
curl is preinstalled on almost all Unix-like systems, macOS, and Windows versions after Windows 10.
CVE-2026-86414 (proxy credential leak) affects all curl versions from 7.10.8 to 8.22.0.
curl 8.23.0 removes SMB(S) support and deprecates CURL_GLOBAL_WIN32 in favor of CURL_GLOBAL_WINSOCK.
curl 8.23.0 contains 24 security fixes, 281 bugfixes, and 476 commits, only 42 days after curl 8.22.0 released on September 2.
Of the 24 security advisories in curl 8.23.0, 23 are rated Low and 1 is High.
CVE-2026-92392 is a use-after-free vulnerability originating from curl mishandling an HTTP/2 RST_STREAM sent by the server; when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM, it causes a use-after-free of struct Curl_easy.
CVE-2026-92392 is the only vulnerability rated High in curl 8.23.0, discovered by an Anthropic researcher using its new OSS Scanner, affecting curl 8.12.0 through 8.22.0, including the command-line tool.
23 more timeline events
All Facts (20)
最近一次被评为HIGH级别的curl CVE（CVE-2023-38545）发布于2023年10月
95%Unverifiedcurl诞生于1998年，由Daniel Stenberg以一个名为httpget的小工具为起点发展而来
95%Unverifiedcurl和Python requests库的TLS握手签名与Chrome浏览器截然不同，容易被反爬系统识别
90%Unverifiedcurl项目将每个选项拆分为独立的.d文件，存放在docs/cmdline-opts/目录下，由构建脚本自动聚合生成最终的man page和网站文档
90%Unverifiedcurl有超过240个命令行选项
90%UnverifiedAndroid系统、macOS、几乎所有Linux发行版均内置curl
90%Unverifiedcurl支持多达30余种网络协议，包括HTTP、HTTPS、FTP、SMTP、IMAP等
85%Unverifiednpm、pip、curl等CLI工具同样依赖环境变量而非系统代理API来获取代理设置
85%Unverified全球超过100亿台设备上运行着curl
75%UnverifiedThe curl project operates a bug bounty program through the HackerOne platform.
60%UnverifiedCurl has been installed more than 20 billion times and runs on virtually every smartphone, tablet, car, television, game console, and server.
60%UnverifiedDaniel Stenberg has maintained curl for more than 25 years.
60%UnverifiedThe difference between Fancy Curl Sites and text browsers is that it directly reuses curl's request pipeline, requires no additional installation of browser-level binaries, and lowers distribution and onboarding costs.
50%UnverifiedFancy Curl Sites is a project that renders the content returned by curl requests into readable, interactive pages, enabling the terminal to present a visual effect close to that of a browser.
50%Unverifiedcurl is an open-source project initiated by Daniel Stenberg in 1996, and its name means Client URL, relying on the libcurl library to make network requests.
50%Unverifiedcurl is preinstalled on almost all Unix-like systems, macOS, and Windows versions after Windows 10.
50%UnverifiedCVE-2026-92392 is the only vulnerability rated High in curl 8.23.0, discovered by an Anthropic researcher using its new OSS Scanner, affecting curl 8.12.0 through 8.22.0, including the command-line tool.
50%UnverifiedCVE-2026-92392 is a use-after-free vulnerability originating from curl mishandling an HTTP/2 RST_STREAM sent by the server; when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM, it causes a use-after-free of struct Curl_easy.
50%Unverifiedcurl 8.23.0 contains 24 security fixes, 281 bugfixes, and 476 commits, only 42 days after curl 8.22.0 released on September 2.
50%UnverifiedOf the 24 security advisories in curl 8.23.0, 23 are rated Low and 1 is High.
50%