Daniel Stenberg

Stories

ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl

Announced curl 8.23.0 with 22 vulnerability fixes for October 14, 2026

curl security researcher Viktor Szakáts reported two ARM64-only miscompiles, one in GCC 15/16 and one in Rust. The claim is contested: no miscompilation bug report was filed with rustc, and the patch has been called 'dubiously correct'.

Updated Oct 15

Notable Quotes

This week in #curl we get to experience not one, but two compiler bugs.

from ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl · Updated Oct 15

We took this decision after we received one particular vulnerability report that highlighted a rather significant flaw.

from ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl · Updated Oct 15

We use all the state-of-the-art tools available to us, to search for problems and strengthen our products—and thereby hopefully keeping the world a little safer. OSS Scanner has helped us find multiple issues in curl worthy of addressing, including one of the worst curl vulnerabilities reported in the last few years.

from ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl · Updated Oct 15