curl security audits
2026: Aisle
Aisle performed a series of rigorous investigations, security scans and an audit of the curl source code from September 2025 to October 2026.
It resulted in hundreds of bugfixes and thirty-five published vulnerabilities.
2026: Trail of Bits
Trail of Bits performed an informal security audit under their Patch the Planet umbrella in June 2026, on which they spent 40 engineering hours and AI powers from Open AI.
It resulted in several bugfixes and one low severtiy CVE.
2024: Trail of Bits
Trail of Bits performed a security audit of curl's HTTP/3 components, published on February 23, 2024.
2022: Trail of Bits
Trail of Bits performed a security audit of curl source code and internals, published on December 21, 2022.
See Threat Model Report & Fix Review and Code Review & Testing Analysis.
2016: Cure 53
Cure 53 performed a security audit, published in August 2016.