Pull to refresh
Logo
What Changed
Following Why Sign Up
ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl

ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl

New Capabilities

curl's ARM64 miscompile report draws doubt as its 22-CVE release date passes

October 14th, 2026: curl 8.23.0 release scheduled

Overview

Updated Oct 15

curl security researcher Viktor Szakáts reported two ARM64-only miscompiles, one in GCC 15/16 and one in Rust. The claim is contested: no miscompilation bug report was filed with rustc, and the patch has been called 'dubiously correct'.

curl 8.23.0 was scheduled to ship October 14 with fixes for 22 CVEs, one rated HIGH (CVE-2026-92392). Anthropic's OSS Scanner, an AI code-scanning tool, helped find multiple curl issues, including one of the worst in recent years, per Daniel Stenberg.

Why it matters

If confirmed, a miscompile means the bug is invisible in source — it exists only in machine code shipped to billions of ARM64 devices.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

I'm confused. Software currently is in a programming language and you can do diffs on them. How could something have shipped and you can't do a diff? Maybe I'm just not understanding.

Because the bug is in the compiler, not in curl's source: the source diffs clean, but the ARM64 machine code the compiler emits is wrong, so the flaw is visible only in the shipped binary, not in the code.

A miscompile makes a vulnerability invisible to source review and AI scanners, so it can ride along in binaries on billions of devices with no trace in the repository.

4 details4 sources1 disagreement
  • Source code is what humans read; what ships is compiled machine code. A compiler bug emits different instructions than the source says, so a diff of the source looks correct.
  • In curl issue 23237, Viktor Szakáts found ARM64 valgrind failures with -O3 that vanish at -O2; clang builds are unaffected, pointing at code generation rather than curl's own logic.
  • The report is still contested: no rustc miscompilation bug was filed, and some commenters say the failures could be undefined behavior in curl/quiche or an OpenSSL assembly bug (gcc bug 118537), not compiler miscompiles.
  • curl 8.23.0 shipped October 14 with 24 security fixes, including the HIGH-rated CVE-2026-92392.
Hacker News discussion Daniel Stenberg's Mastodon post Daniel Stenberg's curl 8.23.0 release post GCC bugzilla 118537
Room for disagreement
  • Stenberg and Szakáts call these two ARM64 compiler miscompiles (GCC 15/16 and Rust), but Hacker News commenters note that no rustc bug report exists, the patch is 'dubiously correct', and the root cause could be undefined behavior in curl or an OpenSSL assembly bug instead.
0 AI answers with web search. May be wrong.

Key Indicators

22
CVEs fixed in curl 8.23.0
Includes one rated HIGH (CVE-2026-92392); release details were scheduled for October 14, not yet confirmed.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

VS
Viktor Szakáts
Security researcher
Reported two ARM64 miscompiles in curl issue 23237; root cause contested
 Daniel Stenberg
Daniel Stenberg
Founder and lead developer of curl
Announced curl 8.23.0 with 22 vulnerability fixes for October 14, 2026

Organizations Involved

curl project
curl project
Open-source software project
Was scheduled to release 8.23.0 on October 14; outcome not yet reported in available sources

Maintains curl and libcurl, data-transfer software installed on billions of devices.
GC
GNU Compiler Collection (GCC)
Free-software compiler suite
Reported to contain an ARM64 optimization bug that miscompiles curl; root cause contested

The GNU Project's compiler suite, the default on most Linux systems.
Rust toolchain
Rust toolchain
Programming language and compiler
Reported to contain an ARM64 miscompile affecting curl; root cause contested

A memory-safe systems language whose compiler backend also carries the miscompile.
Anthropic
Anthropic
AI company
OSS Scanner helped find multiple curl issues, including one of the worst in recent years

AI company whose OSS Scanner code-scanning tool helped find curl vulnerabilities

Timeline

June 2026 October 2026

6 events Latest: October 14th, 2026 · 4 weeks ago
Tap a bar to jump to that date

  1. curl 8.23.0 release scheduled

    Latest Release

    Release was scheduled for this date. All 22 vulnerability details, including CVE-2026-92392, were expected to become public that morning; outcome not yet confirmed.

  2. curl 8.23.0 announced

    Statement

    Stenberg says release ships October 14 with 22 fixes, one rated HIGH.

  3. Two ARM64 miscompiles disclosed

    Disclosure

    Szakáts reports GCC 15/16 and Rust miscompiles; Stenberg confirms on Mastodon.

  4. CVE-2026-98248 published: ARM64 kernel LSE bug

    Disclosure

    A separate ARM64 kernel vulnerability involving per-CPU LSE operations on 8- and 16-bit data. Omitting the size suffix causes the kernel to read and write four bytes where one or two were intended, leading to memory corruption.

  5. Anthropic OSS Scanner finds curl vulnerabilities

    Disclosure

    Anthropic's OSS Scanner, an AI code-scanning tool, helped find multiple curl issues, including one of the worst in recent years, per Daniel Stenberg. The finding may relate to CVE-2026-92392.

  6. curl 8.21.0 fixes 18 CVEs

    Release

    Includes CVE-2026-8932, the oldest curl vulnerability ever reported, dating to 2001.

Scenarios

1

curl 8.23.0 fixes the miscompile vulnerabilities

Likely Resolves by Nov 15, 2026

Discussed by: Curl lead Daniel Stenberg, who announced the October 14 release on his blog

Curl ships 8.23.0 on October 14 with fixes for 22 CVEs. Stenberg pulled the release date forward after receiving one significant vulnerability report. When the release notes appear that morning, they will show whether the ARM64 miscompiles are among the fixed issues. If they are, patching becomes a straightforward upgrade for most users.

2

GCC and Rust ship compiler fixes

Likely Resolves by Q2 2027

Discussed by: Compiler maintainers, who typically release point updates for confirmed miscompilations

GCC and Rust project maintainers treat confirmed miscompiles as high-priority bugs. GCC would fix the ARM64 optimization path in a 15.x or 16.x point release, or in the next major version. Rust ships a new release every six weeks. The fixes would be verifiable through release notes that name the curl-reported bug.

3

The same miscompiles surface in other software

Uncertain Resolves by End of 2027

Discussed by: Security researchers who study compiler bug classes, including Szakáts

If the ARM64 optimization bugs are triggered by general code patterns rather than curl-specific constructs, other security-sensitive software built with GCC 15/16 or Rust could carry identical flaws. Audits of comparable code paths would determine whether the exposure extends beyond curl.

4

Root cause confirmed as UB in curl, not compiler bugs

Possible

Discussed by: Lobsters commenters who question whether the issues are miscompiles or UB

If the ARM64 issues trace to undefined behavior in curl's code rather than compiler bugs, the merged patch would need rework. The curl issue itself says no miscompilation bug report was filed with rustc, and the patch has been called 'dubiously correct' for papering over the problem.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

May 2008

Debian OpenSSL weak keys (CVE-2008-0166)

A Debian packager removed a line from OpenSSL's random-number seeding code in 2006. The change made the PRNG output predictable, so every SSH and SSL key generated on affected Debian systems had only a small number of possible values. Researchers found the flaw in 2008.

Then

Millions of keys across Debian and Ubuntu systems had to be regenerated within days.

Now

It became a textbook case of how a small change outside upstream source can create a security catastrophe.

Why this matters now

Like the curl miscompiles, the vulnerability lived not in the application's logic but in the layer that turns source into a usable system — here the build and packaging process, there the compiler.

February-March 2024

xz-utils supply-chain backdoor (2024)

A contributor later identified as acting with malicious intent added obfuscated code to xz-utils, a compression library widely used in Linux distributions. The code targeted OpenSSH's build process to plant a backdoor in sshd on affected systems. It was discovered before wide deployment.

Then

The backdoor was neutralized within days of discovery.

Now

It drove a reckoning about trusting the build toolchain and the maintainers who control it.

Why this matters now

The curl case is the same layer failing without malice: the compiler generated faulty code. Both show that the components that build software are themselves security-critical.

Sources

(9)
+3
Mastodon Lobsters GitHub World Programming Society daniel.haxx.se AISLE Marc Pope Neowin OpenCVE