4 stories
CVE-2026-111497 (CVSS 9.2) lets a crafted Brotli stream trigger an out-of-bounds write, and it works in both directions: a malicious server can hit a client, and a malicious client can hit a server.
The thread argued about the name. Whether HTTP is really exposed turned out to depend on one setting.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
The trick is three lines: open file descriptor 3 on /dev/tcp, printf a raw GET with CRLF headers, then cat the descriptor back. The Connection: close header is load-bearing — drop it and cat waits forever.
But the loudest reply in the thread was a correction: Bash does not speak HTTP. It opens a socket and you speak HTTP, badly. The toy client doesn't parse responses and breaks on redirects, chunking, or TLS.
The HackerOne form and security email go dark July 1 to August 3, and the 8.22.0 release slips two weeks to September 2. Daniel Stenberg's reasoning is plain: the team is burnt out and needs rest.
The thread half-celebrates, half-worries about one loophole: paid support clients can still pressure for a fix if someone discloses publicly during the freeze — and curl, for all its ubiquity, has no second on-call human.
The author's claim: if a Rust function isn't marked unsafe, it's impossible to use incorrectly in a memory sense, so a memory bug there is always a soundness hole. C and C++ shift that burden to the caller, so the same class of mistake never becomes a CVE.
The thread split hard. One camp: CVE counts are so useless they ignore anyone citing them. Another, channeling Stroustrup: most of these bugs are C-style C++, and modern C++ plus hardened libraries closes the gap.
