CVE and update status of the FreeBSD ports tree3,310 unaddressed CVEs in 678 portsAll times are CET
Port details

ftp/curl 8.23.0

Command line tool and library for transferring data with URLs

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 8.23.0
Upstream
up to date
Last update
to 8.23.0 · 1c19f23423
Quarterly
2026Q4: 8.23.0 · last MFH 0b6d7a71f4
WWW
https://curl.se/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install curl
installs 8.23.0 from latest; from quarterly (2026Q4) 8.23.0
Port
# cd /usr/ports/ftp/curl && make install clean
# make -C /usr/ports/ftp/curl config  # change options first
Size
1.9 MiB download · 5.7 MiB installed
Depends on
archivers/brotli 1.2.1,1, archivers/zstd 1.5.7_2, dns/libidn2 2.3.8, dns/libpsl 0.23.3, security/libssh2 1.11.1_1,3, www/libnghttp2 1.70.0
License
MIT
Options
30 of 40 on in the package: ALTSVC BROTLI COOKIES DICT DOCS EXAMPLES FTP GOPHER GSSAPI_BASE HTTP HTTP2 IDN IMAP IPFS IPV6 LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMTP STATIC TELNET TFTP THREADED_RESOLVER WEBSOCKET ZSTD
Show the 10 options that are off
CARES DEBUG GNUTLS GSSAPI_MIT GSSAPI_NONE LDAP LDAPS LIBSSH LIBUV WOLFSSL

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 168.23.08.22.0–
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 8.23.0.

Fixed (55)

Show 55 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298586maintainer-feedback? ftp/curl: support Rustls for TLSNew2026-09-18
297733maintainer-feedback? ftp/curl: Multiple options are missing IMPLIESNew2026-08-22
297732maintainer-feedback? ftp/curl: Multiple options are missing dependencies for unit testsNew2026-08-22
294115maintainer-feedback? ftp/curl: Incorrect dependency for libssh and libssh2 after b889b19eb5e30e1c77d57d0e43977b4af9a0cbb5New2026-05-15
288123maintainer-feedback? ftp/curl: Add HTTP/3 Support (preliminary diff)New2026-04-08

Commits (435)

Sunpoet Po-Chuan Hsieh (sunpoet) · 7.60.0
Update to 7.60.0

Changes:	https://curl.haxx.se/changes.html
Security:	04fe6c8d-2a34-4009-a81e-e7a7e759b5d2
MFH:		2018Q2
2b5ca33374
Rene Ladan (rene) · 7.59.0
Drop support for expired security/polarssl13
2a5c72ab87
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.59.0
Fix build with LibreSSL 2.7

Obtained from:	https://github.com/openbsd/ports/blob/master/net/curl/patches/patch-lib_vtls_openssl_c
PR:		226845
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl>
MFH:		2018Q1
f6ec15f572
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.59.0
Update to 7.59.0

Changes:	https://curl.haxx.se/changes.html
95ecddb46b
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0_3
Update dns/libpsl to 0.20.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/rockdaboot/libpsl/blob/master/NEWS
		https://github.com/rockdaboot/libpsl/blob/libpsl-0.20.1/NEWS
3b63c52143
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0_2
Update options dependency
e0846397bf
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0_2
Update dns/libpsl to 0.20.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://github.com/rockdaboot/libpsl/blob/master/NEWS
5a86ebc1e7
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0_1
Fix build with CURL_DEBUG enabled

lib/checksrc.pl is run when CURL_DEBUG is enabled.
The build failed due to the long line in patched lib/url.c.

./url.c:593:82: warning: Longer than 79 columns (LONGLINE)
       data->set.no_signal = TRUE; /* different handling of signals and threads */
checksrc: 0 errors and 1 warnings
checksrc: 0 errors and 5 warnings suppressed
gmake[3]: *** [Makefile:3935: checksrc] Error 5

MFH:		2018Q1
35ac318764
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0_1
Fix r460400

- Add DICT, FTP, GOPHER, TELNET and TFTP options to OPTIONS_DEFAULT
- Add HTTP options to OPTIONS_DEFAULT
- Bump PORTREVISION for package change

DICT, FTP, GOPHER, TELNET and TFTP options are enabled by default through configure but not being added to OPTIONS_DEFAULT in r460440.
HTTP option is enabled by default through HTTP2 option.
405da093cc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0
Add more options

- Add protocol group
- Convert already-enabled protocols to IMAP, POP3, RTSP and SMTP options
- Add DICT, FTP, GOPHER, HTTP, TELNET and TFP options
- Update CA_BUNDLE_DESC
- Use CA_BUNDLE_CONFIGURE_WITH and OPENSSL_CONFIGURE_WITH
- Merge TLS_SRP check

PR:		223967 (based on)
Submitted by:	brnrd
204809ac75
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0
Fix BROTLI option
ed62412da2
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0
Remove LIBSSH option to avoid circular dependency

libssh uses cmake which depends on curl.
b5b1d4039c
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.58.0
Update to 7.58.0

- Add BROTLI and LIBSSH options

Changes:	https://curl.haxx.se/changes.html
34d77595c1
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.57.0
Disable brotli support to fix build with old brotli installed

Brotli support will be added as an option after archivers/brotli being updated
to a newer version.

PR:             224072
Reported by:    mi
c5b066f003
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.57.0
Update to 7.57.0

Changes:	https://curl.haxx.se/changes.html
		https://curl.haxx.se/docs/security.html
Security:	301a01b7-d50e-11e7-ac58-b499baebfeaf
MFH:		2017Q4
fe18ac14f3
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.56.1
Update to 7.56.1

Changes:	https://curl.haxx.se/changes.html
		https://curl.haxx.se/docs/security.html
Security:	143ec3d6-b7cf-11e7-ac58-b499baebfeaf
MFH:		2017Q4
3336e7583a
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.56.0
Update to 7.56.0

Changes:	https://curl.haxx.se/changes.html
Security:	ccace707-a8d8-11e7-ac58-b499baebfeaf
MFH:		2017Q4
7d5e15be23
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.55.1
Update MASTER_SITES

PR:		221724
Submitted by:	xmj
7e7cd5ef91
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.55.1
Change RESOLV from RADIO to SINGLE

cURL 7.55.1 use the threaded resolver (THREADED_RESOLVER) backend if c-ares
(CARES) is not available. That means you must enable either CARES or
THREADED_RESOLVER (default) option.

Reference:	https://github.com/curl/curl/pull/1647
MFH:		2017Q3
922cbc69c0
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.55.1
Update to 7.55.1

Changes:	https://curl.haxx.se/changes.html
MFH:		2017Q3
517d6198cc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.55.0
Update to 7.55.0

Changes:	https://curl.haxx.se/changes.html
Security:	69cfa386-7cd0-11e7-867f-b499baebfeaf
PR:		221362
Submitted by:	brnrd
MFH:		2017Q3
5f223850d7
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.54.1
Update COMMENT and pkg-descr
6392a83fee
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.54.1
Update to 7.54.1

Changes:	https://curl.haxx.se/changes.html
Security:	9314058e-5204-11e7-b712-b1a44a034d72
MFH:		2017Q2
a9da0a91c9
Dmitry Marakasov (amdmi3) · 7.54.0
- Update WWW

Approved by:	portmgr blanket
fecab415cc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.54.0
Update to 7.54.0

Changes:	https://curl.haxx.se/changes.html
Security:	3e2e9b44-25ce-11e7-a175-939b30e0836d
MFH:		2017Q2
8959621de9
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.53.1_1
Fix HTTP2 option

PR:		218721
Reported by:	<dewayne@heuristicsystems.com.au>
MFH:		2017Q2
605658c4d8
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.53.1_1
Fix CVE-2017-7407

- Bump PORTREVISION for package change

Obtained from:	https://curl.haxx.se/CVE-2017-7407.patch
		https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13
		https://github.com/curl/curl/commit/8e65877870c1fac920b65219adec720df810aab9
Security:	04f29189-1a05-11e7-bc6e-b499baebfeaf
MFH:		2017Q2
fca9a15726
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.53.1
Cosmetic change
0fc9c0de9f
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.53.1
Update to 7.53.1

Changes:	https://curl.haxx.se/changes.html
6ca735be73
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.53.0
Update to 7.53.0

Changes:	https://curl.haxx.se/changes.html
Security:	311e4b1c-f8ee-11e6-9940-b499baebfeaf
f6c7463135
Tijl Coosemans (tijl) · 7.52.1_1
- Remove inclusion of bsd.default-versions.mk from ftp/curl/Makefile so   bsd.default-versions.mk can rely on ARCH being defined. - In bsd.port.mk move inclusion of bsd.default-versions.mk from the   pre-makefile section to the options section so the variables can be used   earlier.  Also put the bit of code sitting between the options section and   the pre-makefile section into the options sectio

PR:		215996
Exp-run by:	antoine
Approved by:	portmgr (antoine)
6d324c1f70
Tijl Coosemans (tijl) · 7.52.1_1
The output of tools like awk, date, sort, tr,... depends on the current locale set by the user.  Add LANG=C and LC_ALL=C at the beginning of bsd.port.mk and export them so all commands are executed with the C locale. LC_ALL=C overrides all other LC_* variables.  LANG is used by setlocale(3) as default value for LC_* variables, so normally it isn't used when LC_ALL is set, but there's code out ther

Introduce USE_LOCALE=<locale> that adds LANG=<locale> and LC_ALL=<locale> to
CONFIGURE_ENV and MAKE_ENV so upstream build systems can be executed with a
different locale (e.g. USE_LOCALE=en_US.UTF-8).

PR:		215882
Exp-run by:	antoine
Approved by:	portmgr (antoine)
02f27a83b4
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.52.1_1
Fix net-p2p/rtorrent with https trackers

- Bump PORTREVISION for package change

Reference:	https://github.com/rakshasa/rtorrent/issues/538
Obtained from:	https://github.com/curl/curl/commit/a7b38c9dc98481e4a5fc37e51a8690337c674dfb
MFH:		2017Q1
5b72772a8c
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.52.1
- Update to 7.52.1

Changes:	https://curl.haxx.se/changes.html
Security:	c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4
MFH:		2016Q4
4a12f85bb5
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.52.0
- Update to 7.52.0

Changes:	https://curl.haxx.se/changes.html
Security:	42880202-c81c-11e6-a9a5-b499baebfeaf
MFH:		2016Q4
db936e2edc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_5
- Remove BUILD_DEPENDS and RUN_DEPENDS:   - RUN_DEPENDS: BUILD_DEPENDS is sufficient to block unqualified version.   - BUILD_DEPENDS: it's safe to remove BUILD_DEPENDS after nghttp2->libnghttp2 transition because initial version of libnghttp2 is 1.0.0+.

Pointed out by:	adamw
b9c701d7b8
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_5
- Change HTTP2 dependency from www/nghttp2 to www/libnghttp2 - Enable HTTP2 option by default - Bump PORTREVISION for dependency and package change
19c76abeae
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_4
- Add net to CATEGORIES

PR:		205269
Suggested by:	<bkazemi@users.sf.net>
8d716fefa7
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_4
- Update to 0.16.1 - Bump PORTREVISION for dependent ports

Changes:	https://github.com/rockdaboot/libpsl/blob/master/NEWS
619c99ffbb
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_3
- Update to 0.16.0 - Bump PORTREVISION for dependent ports

Changes:	https://github.com/rockdaboot/libpsl/blob/master/NEWS
7951f57490
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_2
- Cleanup Makefile   - Remove BUILDING_HIPHOP check: curl-hiphop was removed in r425765   - Use = instead of += for MAINTAINER, COMMENT, CONFIGURE_ARGS and CONFIGURE_ENV   - Remove SLAVEDIRS   - Adjust line wrapping of DOCS
a2f5416085
Tijl Coosemans (tijl) · 7.51.0_2
Remove libcurl.so.7 compatibility link that was added in r374303 to prevent massive PORTREVISION bumps.  Bump dependent ports that have not been bumped since.
61b6b4348f
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_1
- Sort PLIST
b057f9785d
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_1
- Add SMB option

PR:		210472
Submitted by:	Marcin Gryszkalis <mg@fork.pl>
fc0f70a87d
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.51.0_1
- Fix IDN option - Sort PLIST - Bump PORTREVISION for dependency change

MFH:		2016Q4
047648852e
Mark Felder (feld) · 7.51.0
ftp/curl: Update to 7.51.0

- Update to 7.51.0
- Fixes 11 security vulnerabilities
- Remove docs no longer installed from plist

PR:		214000
MFH:		2016Q4
Security:	765feb7d-a0d1-11e6-a881-b499baebfeaf
Security:	CVE-2016-8615
Security:	CVE-2016-8616
Security:	CVE-2016-8617
Security:	CVE-2016-8618
Security:	CVE-2016-8619
Security:	CVE-2016-8620
Security:	CVE-2016-8621
Security:	CVE-2016-8622
Security:	CVE-2016-8623
Security:	CVE-2016-8624
Security:	CVE-2016-8625
a554fbb056
Mathieu Arnold (mat) · 7.50.3_1
Use USES=pathfix where applicable.

PR:		213195
Submitted by:	mat
Exp-run by:	antoine
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D8093
a0bcd2cf68
Jan Beich (jbeich) · 7.50.3_1
devel/nspr, security/nss: drop version from SONAME

No other downstream appends synthetic library version, and doing so
causes underlinking due to fragile build system (see below). Not to
mention being unable to swap out bundled libs from upstream builds.

  $ cc -lplds4 -L/usr/local/lib
  /usr/lib/crt1.o: In function `_start1':
  crt1_c.c:(.text+0xa6): undefined reference to `main'
  /usr/local/lib/libplds4.so: undefined reference to `pthread_set_name_np'
  /usr/local/lib/libplds4.so: undefined reference to `pthread_create'
  /usr/local/lib/libplds4.so: undefined reference to `pthread_condattr_init'
  /usr/local/lib/libplds4.so: undefined reference to `pthread_setschedparam'
  /usr/local/lib/libplds4.so: undefined reference to `pthread_getschedparam'

PR:		213144
Exp-run by:	antoine
f5f47a5a4e
Mark Felder (feld) · 7.50.3
ftp/curl: Update to 7.50.3

- Update installed docs

PR:		212677
MFH:		2016Q3
Security:	CVE-2016-7167
5635e9adc4
John Marino (marino) · 7.50.1
ftp/curl: Remove second redundant ports SSL + base GSSAPI check

If one tries to use the base gssapi with SSL from ports, gssapi.mk
will add an IGNORE entry.

Suggested by:	mat
74f2e01aa4