Daniel Stenberg

Stories

ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl

Announced curl 8.23.0 with 22 vulnerability fixes for October 14, 2026

curl security researcher Viktor Szakáts found two ARM64-only compiler miscompiles that silently produced vulnerable machine code in curl: one in GCC 15/16, one in Rust. The bugs turn optimization errors into exploitable flaws that appear only on ARM64 hardware, from Apple Silicon Macs to AWS Graviton servers.

Updated 1 hour ago

Notable Quotes

This week in #curl we get to experience not one, but two compiler bugs.

from ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl · Updated 1 hour ago

We took this decision after we received one particular vulnerability report that highlighted a rather significant flaw.

from ARM64 compiler bugs in GCC and Rust open vulnerabilities in curl · Updated 1 hour ago