daniel.haxx.se

Daniel Stenberg, creator and lead developer of curl, describes the unprecedented pressure the curl project is currently under. Security report submissions have increased 4-5x compared to 2024, now averaging more than one per day, with unusually high quality and detail. The team already has 12 confirmed vulnerabilities pending for the next release — a project record — and is on track to publish 30+ CVEs in 2026 before mid-year. Stenberg shares the personal and health toll this is taking, including concerns from his wife about work-life balance. He calls on companies that depend on curl commercially to fund the project and distribute the workload. Despite the strain, he notes a positive trend: all recent vulnerabilities have been rated LOW or MEDIUM severity, and every fixed bug makes curl better.

The pressure

To be honest: Daniel should let go for a bit. The grind will burn him and his team out if he continues like this.
If anything needs to burn here, it’s the surrounding “community”. If the team continues like this, they give out a signal that they can take the load on themselves.
Leave it for a while, concentrate on your work/life balance. Let the vultures suffer the consequences instead. If you try to please everyone, they’ll just keep on taking. If they burn, they might eventually learn nothing comes free.

Sad to see it goes on heavy pressure for him. I hope he will find some financial support or help from the community. We should take care of these lonely developers maintaining what looks small but does great !

The increase in reports isn’t necessarily bad news. More eyes on the code means more bugs are being found before attackers exploit them. The fact that most findings are low or medium severity suggests the project’s security posture is actually fairly strong.