Aisle Discovers 6 New CVEs in Curl, Including the Oldest Issue Ever Reported
Security researchers at Aisle discovered six new CVEs in the curl and libcurl library, including the oldest reported issue in the project's history. The vulnerabilities range from a 2009 double-free bug to various crash-inducing flaws, all of which have been patched by the curl project.
Background
- **cURL** (often written "curl") is a ubiquitous open-source command-line tool and library for transferring data using network protocols (HTTP, FTP, etc.). It's embedded in billions of devices: operating systems, cars, routers, smart TVs, and software development tools.
- **CVE** (Common Vulnerabilities and Exposures) is a standardized identifier for publicly known security vulnerabilities. Companies and researchers report bugs by assigning a CVE number so users know what to patch.
- **Aisle** is a cybersecurity firm that regularly audits open-source software for flaws. Finding 6 CVEs in a single project is notable; describing one as the "oldest issue ever reported" means the bug had been present in curl's codebase for an unusually long time, possibly decades, before being detected.
- These discoveries matter because curl's near-universal use means any vulnerability could affect countless systems. The "oldest issue" suggests a fundamental, long-hidden weakness that may now be fixed, reducing risk for everyone who updates.