CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

ftp/curl 8.23.0

Command line tool and library for transferring data with URLs

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 8.23.0
Upstream
up to date
Last update
to 8.23.0 · 1c19f23423
Quarterly
2026Q4: 8.23.0 · last MFH 0b6d7a71f4
WWW
https://curl.se/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install curl
installs 8.23.0 from latest; from quarterly (2026Q4) 8.23.0
Port
# cd /usr/ports/ftp/curl && make install clean
# make -C /usr/ports/ftp/curl config  # change options first
Size
1.9 MiB download · 5.7 MiB installed
Depends on
archivers/brotli 1.2.1,1, archivers/zstd 1.5.7_2, dns/libidn2 2.3.8, dns/libpsl 0.23.3, security/libssh2 1.11.1_1,3, www/libnghttp2 1.70.0
License
MIT
Options
30 of 40 on in the package: ALTSVC BROTLI COOKIES DICT DOCS EXAMPLES FTP GOPHER GSSAPI_BASE HTTP HTTP2 IDN IMAP IPFS IPV6 LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMTP STATIC TELNET TFTP THREADED_RESOLVER WEBSOCKET ZSTD
Show the 10 options that are off
CARES DEBUG GNUTLS GSSAPI_MIT GSSAPI_NONE LDAP LDAPS LIBSSH LIBUV WOLFSSL

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 168.23.08.22.0–
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 8.23.0.

Fixed (55)

Show 55 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298586maintainer-feedback? ftp/curl: support Rustls for TLSNew2026-09-18
297733maintainer-feedback? ftp/curl: Multiple options are missing IMPLIESNew2026-08-22
297732maintainer-feedback? ftp/curl: Multiple options are missing dependencies for unit testsNew2026-08-22
294115maintainer-feedback? ftp/curl: Incorrect dependency for libssh and libssh2 after b889b19eb5e30e1c77d57d0e43977b4af9a0cbb5New2026-05-15
288123maintainer-feedback? ftp/curl: Add HTTP/3 Support (preliminary diff)New2026-04-08

Commits (435)

Po-Chuan Hsieh (sunpoet) · 8.7.1
ftp/curl: Update to 8.7.1

Changes:	https://curl.se/changes.html
Security:	CVE-2024-2004, CVE-2024-2398, CVE-2024-2379, CVE-2024-2466
3cc1c82ba9
Po-Chuan Hsieh (sunpoet) · 8.6.0
ftp/curl: Clean up

- Update LDAPS_DESC
- Fix CONFIGURE_ARGS
- Clean up patches

USES=autoreconf can be removed after next version update.
82670b6f51
Yasuhiro Kimura (yasu) · 8.6.0
ftp/curl: Update to 8.6.0

ChangeLog:	https://curl.se/changes.html#8_6_0
PR:		276879
Approved by:	maintainer
Exp-run bye:	antoine
MFH:		2024Q1
Security:	02e33cd1-c655-11ee-8613-08002784c58d
ed937bd9ad
Po-Chuan Hsieh (sunpoet) · 8.5.0_1
ftp/curl: Sort PLIST after af6e33647c85c0e176f2015cd97b5fab33312fd5
9141258e22
Muhammad Moinur Rahman (bofh) · 8.5.0_1
ftp/curl: Moved man to share/man

Approved by:    portmgr (blanket)
af6e33647c
Po-Chuan Hsieh (sunpoet) · 8.5.0
ftp/curl: Update to 8.5.0

Changes:	https://curl.se/changes.html
Security:	CVE-2023-46218, CVE-2023-46219
8373adcb9b
Po-Chuan Hsieh (sunpoet) · 8.4.0
ftp/curl: Update to 8.4.0

Changes:	https://curl.se/changes.html
Security:	CVE-2023-38545, CVE-2023-38546
3098973bd0
Po-Chuan Hsieh (sunpoet) · 8.3.0_1
ftp/curl: Convert to options helper
aabdfa405a
Dag-Erling Smørgrav (des) · 8.3.0_1
ftp/curl: Always use the default trust store instead of ca_root_nss.

MFH:		2023Q4
Reviewed by:	sunpoet
Differential Revision:	https://reviews.freebsd.org/D42039
4881eceec9
Po-Chuan Hsieh (sunpoet) · 8.3.0
ftp/curl: Update to 8.3.0

Changes:	https://curl.se/changes.html
Security:	CVE-2023-38039
06bb67aa58
Po-Chuan Hsieh (sunpoet) · 8.2.1
ftp/curl: Update to 8.2.1

Changes:	https://curl.se/changes.html
6583e2c766
Po-Chuan Hsieh (sunpoet) · 8.1.2
ftp/curl: Update to 8.1.2

Changes:	https://curl.se/changes.html
3cfc8e7d0f
Renato Botelho (garga) · 8.1.1
ftp/curl: Update to 8.1.1

Upgrade to 8.1.0 broke the build on recent CURRENT and this version
contains a fix for that

PR:		271526
Reported by:	O. Hartmann <ohartmann@walstatt.org>
Fixes:		5fae3323ed2f9a1d203ccaed617ed49dec9d85ce
Pointy hat to:	garga
MFH:		2023Q2
Sponsored by:	Rubicon Communications, LLC ("Netgate")
ad3e4398e4
Renato Botelho (garga) · 8.1.0
ftp/curl: Update to 8.1.0

PR:		271497
Security:	CVE-2023-28319
		CVE-2023-28320
		CVE-2023-28321
		CVE-2023-28322
Sponsored by:	Rubicon Communications, LLC ("Netgate")
5fae3323ed
Po-Chuan Hsieh (sunpoet) · 8.0.1
ftp/curl: Add LIBSSH option
c5da045eae
Po-Chuan Hsieh (sunpoet) · 8.0.1
ftp/curl: Add WEBSOCKET option
dbddaf5a1b
Po-Chuan Hsieh (sunpoet) · 8.0.1
ftp/curl: Convert REINPLACE_CMD to patch files
c312e7f6fc
Po-Chuan Hsieh (sunpoet) · 8.0.1
ftp/curl: Update to 8.0.1

Changes:	https://curl.se/changes.html
0799d457b1
Po-Chuan Hsieh (sunpoet) · 7.88.1
ftp/curl: Use complete arguments/options
b91537add9
Yasuhiro Kimura (yasu) · 7.88.1
ftp/curl: Update to 7.88.1

ChangeLog:	https://curl.se/changes.html#7_88_1
PR:		269967
Approved by:	maintainer timeout
MFH:		2023Q1
Security:	be233fc6-bae7-11ed-a4fb-080027f5fec9
90ac2baf0f
Muhammad Moinur Rahman (bofh) · 7.87.0_1
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap

Convert the USE_LDAP=yes to USES=ldap and adds the following features:

- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
  RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features

Reviewed by:	delphij
Approved by:	portmgr
Differential Revision: https://reviews.freebsd.org/D38233
6e1233be22
Tijl Coosemans (tijl) · 7.87.0_1
ftp/curl: Fix OPENSSL_CONFIGURE_WITH

Upstream renamed --with-ssl to --with-openssl, and --without-ssl now
means no SSL at all.  This fixes building with SSL libraries other than
OpenSSL.

Approved by:	sunpoet (via email)
a03dc3f428
Antoine Brodin (antoine) · 7.87.0_1
ftp/curl: re-enabled CA_BUNDLE by default

With hat:	pkgmgr
41dd4f9d62
Po-Chuan Hsieh (sunpoet) · 7.87.0
ftp/curl: Update to 7.87.0

- Update WWW
- Disable CA_BUNDLE option by default

ca_root_nss is not needed since we have caroot in the base system.

Changes:	https://curl.se/changes.html
Security:	CVE-2022-43551, CVE-2022-43552
c63a8f65af
Yasuhiro Kimura (yasu) · 7.86.0
ftp/curl: Update to 7.86.0

While here,

* Switch to DISTVERSION.
* Pet portlint and portclippy.
* Tidy up Makefile with portfmt.

ChangeLog:	https://curl.se/changes.html#7_86_0
PR:		267802
Approved by:	maintainer timeout
MFH:		2022Q4
Security:	0f99a30c-7b4b-11ed-9168-080027f5fec9
78ae7128f6
Stefan Eßer (se) · 7.85.0
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 7.85.0
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Po-Chuan Hsieh (sunpoet) · 7.85.0
ftp/curl: Update to 7.85.0

Changes:	https://curl.se/changes.html
Security:	CVE-2022-35252
9822bfc875
Tobias C. Berner (tcberner) · 7.84.0
ftp: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Alexander Kriventsov
  *  Anders Nordby <anders@fix.no>
  *  Andreas Fehlner <fehlner@gmx.de>
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Zakhvatov
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Chris Piazza <cpiazza@FreeBSD.org>
  *  Damjan Marion <dmarion@open.hr>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Eric Freeman <freebsdports@chillibear.com>
  *  Frank DENIS
  *  Frank Laszlo <laszlof@vonostingroup.com>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@ccca.nctu.edu.tw>
  *  George V. Neville-Neil <gnn@FreeBSD.org>
  *  Hye-Shik Chang
  *  Jordan Hubbard <jkh@FreeBSD.org>
  *  Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe>
  *  Joseph Benden <joe@thrallingpenguin.com>
  *  Ju Pengfei <jupengfei@gmail.com>
  *  Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw>
  *  Mark Johnston <markj@FreeBSD.org>
  *  Martin Matuska (mm@FreeBSD.org)
  *  Marwan BURELLE <marwan.burelle@lri.fr>
  *  Maxim Ignatenko
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Neil Blakey-Milner
  *  Neil Blakey-Milner <nbm@rucus.ru.ac.za>
  *  Nick Leuta
  *  Nosov Artem <chip-set@mail.ru>
  *  Petr Holub <hopet@ics.muni.cz>
  *  Philippe Le Berre <philippe@le-berre.com>
  *  Piotr Kubaj <pkubaj@anongoth.pl>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Roman Bogorodskiy
  *  Sergey Matveychuk <sem@FreeBSD.org>
  *  Sergey Skvortsov <skv@FreeBSD.org>
  *  Stephane Legrand
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Tom McLaughlin <tmclaugh@sdf.lonestar.org>
  *  Tomokazu ISHII <t-ishii@tryplanet.com>
  *  Ulrich Spoerlein <uspoerlein@gmail.com>
  *  Wen Heping <wen@FreeBSD.org>
  *  Xavier Beaudouin <kiwi@oav.net>
  *  Yasuhiro Fukuma <yasuf@big.or.jp>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  ache
  *  cy@FreeBSD.org
  *  ijliao
  *  ports
  *  torstenb
  *  will

With hat:	portmgr
30cd242001
Po-Chuan Hsieh (sunpoet) · 7.84.0
ftp/curl: Update to 7.84.0

Changes:	https://curl.se/changes.html
Security:	CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, CVE-2022-32208
Security:	ae5722a6-f5f0-11ec-856e-d4c9ef517024
7026df49e8
Po-Chuan Hsieh (sunpoet) · 7.83.1
ftp/curl: Update to 7.83.1

Changes:	https://curl.se/changes.html
Security:	CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27781, CVE-2022-27782, CVE-2022-30115
55208e0f66
Po-Chuan Hsieh (sunpoet) · 7.83.0
ftp/curl: Update to 7.83.0

Changes:	https://curl.se/changes.html
Security:	CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, CVE-2022-27776
Security:	92a4d881-c6cf-11ec-a06f-d4c9ef517024
b6762dd511
Po-Chuan Hsieh (sunpoet) · 7.82.0_1
ftp/curl: Enable PSL option by default

- Bump PORTREVISION for dependency change
fd03c8280e
Po-Chuan Hsieh (sunpoet) · 7.82.0
ftp/curl: Remove deprecated NSS option

- Update CA_BUNDLE_DESC: Remove unsupported mbedTLS

PR:		262955
Submitted by:	diizzy
c224916d09
Po-Chuan Hsieh (sunpoet) · 7.82.0
ftp/curl: Update to 7.82.0

Changes:	https://curl.se/changes.html
5b328bb789
Po-Chuan Hsieh (sunpoet) · 7.81.0
ftp/curl: Update to 7.81.0

Changes:	https://curl.se/changes.html
6ac07e9080
Po-Chuan Hsieh (sunpoet) · 7.80.0
ftp/curl: Update to 7.80.0

Changes:	https://curl.se/changes.html
8b29dfbb22
Po-Chuan Hsieh (sunpoet) · 7.79.1
ftp/curl: Update to 7.79.1

Changes:	https://curl.se/changes.html
0acc6cf1fa
Po-Chuan Hsieh (sunpoet) · 7.79.0
ftp/curl: Update to 7.79.0

Changes:	https://curl.se/changes.html
3805ef230a
Po-Chuan Hsieh (sunpoet) · 7.78.0
ftp/curl: Update to 7.78.0

- Remove METALINK option: all support removed by upstream
- Update NTLM option: it has own configure option now

Changes:	https://curl.se/changes.html
ee05a0fbe5
Po-Chuan Hsieh (sunpoet) · 7.77.0_1
ftp/curl: Add MQTT option

PR:		256627
Requested by:	Michael Osipov <michael.osipov@siemens.com>
9fe030bf07
Po-Chuan Hsieh (sunpoet) · 7.77.0_1
ftp/curl: Add STATIC option

PR:		254622
Reported by:	Daniel Engberg <daniel.engberg.lists@pyret.net>
8ec683f2a9
Po-Chuan Hsieh (sunpoet) · 7.77.0_1
ftp/curl: Enable LIBSSH2 option by default

- Bump PORTREVISION for dependency change

PR:		253939
Requested by:	Dennis Clarke <dclarke@blastwave.org>
dd4df09808
Po-Chuan Hsieh (sunpoet) · 7.77.0
ftp/curl: Update to 7.77.0

Changes:	https://curl.se/changes.html
635a862037
Dmitry Marakasov (amdmi3) · 7.76.1
ftp/curl: remove non-option from OPTIONS_DEFAULT

Approved by:	portmgr blanket
e23ef40bcd
Po-Chuan Hsieh (sunpoet) · 7.76.1
ftp/curl: Cosmetic change
c7394fd8f2
Po-Chuan Hsieh (sunpoet) · 7.76.1
ftp/curl: Update to 7.76.1

- Update MASTER_SITES

Changes:	https://curl.haxx.se/changes.html
013715b562
Po-Chuan Hsieh (sunpoet) · 7.76.0
ftp/curl: Update to 7.76.0

Changes:	https://curl.haxx.se/changes.html
d45ce11e9a
Mathieu Arnold (mat) · 7.75.0
Remove # $FreeBSD$ from Makefiles.
305f148f48
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.75.0
Update to 7.75.0

Changes:	https://curl.haxx.se/changes.html
c07f3fbf62