The OpenSSF engaged Trail of Bits to review the security of cURL. cURL audit results The audit report and the threat model are already published. The blog article describes a bit the process of fuzzing argv. Maintainer Daniel Stenberg was pleased that the auditors found only two actual security problems, the HTTP proxy double free CVE-2022-42915 and the use-after-free CVE-2022-43552, while disagreeing with some of the report’s recommendations.
