CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

ftp/curl 8.23.0

Command line tool and library for transferring data with URLs

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 8.23.0
Upstream
up to date
Last update
to 8.23.0 · 1c19f23423
Quarterly
2026Q4: 8.23.0 · last MFH 0b6d7a71f4
WWW
https://curl.se/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install curl
installs 8.23.0 from latest; from quarterly (2026Q4) 8.23.0
Port
# cd /usr/ports/ftp/curl && make install clean
# make -C /usr/ports/ftp/curl config  # change options first
Size
1.9 MiB download · 5.7 MiB installed
Depends on
archivers/brotli 1.2.1,1, archivers/zstd 1.5.7_2, dns/libidn2 2.3.8, dns/libpsl 0.23.3, security/libssh2 1.11.1_1,3, www/libnghttp2 1.70.0
License
MIT
Options
30 of 40 on in the package: ALTSVC BROTLI COOKIES DICT DOCS EXAMPLES FTP GOPHER GSSAPI_BASE HTTP HTTP2 IDN IMAP IPFS IPV6 LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMTP STATIC TELNET TFTP THREADED_RESOLVER WEBSOCKET ZSTD
Show the 10 options that are off
CARES DEBUG GNUTLS GSSAPI_MIT GSSAPI_NONE LDAP LDAPS LIBSSH LIBUV WOLFSSL

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 168.23.08.22.0–
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 8.23.0.

Fixed (55)

Show 55 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298586maintainer-feedback? ftp/curl: support Rustls for TLSNew2026-09-18
297733maintainer-feedback? ftp/curl: Multiple options are missing IMPLIESNew2026-08-22
297732maintainer-feedback? ftp/curl: Multiple options are missing dependencies for unit testsNew2026-08-22
294115maintainer-feedback? ftp/curl: Incorrect dependency for libssh and libssh2 after b889b19eb5e30e1c77d57d0e43977b4af9a0cbb5New2026-05-15
288123maintainer-feedback? ftp/curl: Add HTTP/3 Support (preliminary diff)New2026-04-08

Commits (435)

Sunpoet Po-Chuan Hsieh (sunpoet) · 7.41.0
- Update to 7.41.0

Changes:	http://curl.haxx.se/changes.html
d28501f75f
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.40.0
- Use INSTALL_TARGET=install-strip instead of MAKE_ENV=INSTALL_STRIP_FLAG=${STRIP}
7bfd7fb64b
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.40.0
- Update to 7.40.0

Changes:	http://curl.haxx.se/changes.html
Security:	CVE-2014-8150
Security:	CVE-2014-8151
MFH:		2015Q1
ca0f66ae24
Antoine Brodin (antoine) · 7.39.0_1
Don't create an orphan symlink for the curl-hiphop slave
c98a94d188
Tijl Coosemans (tijl) · 7.39.0_1
Replace USES=libtool:oldver with USES=libtool or USES=libtool:keepla in the 32 ports that still use it.  Bump PORTREVISION on their dependent ports except the ones that depend on these:

audio/libogg
audio/libvorbis
devel/pcre
ftp/curl
graphics/jpeg
graphics/libart_lgpl
graphics/tiff
textproc/expat2
textproc/libxslt

In these cases the same trick as in the recent gettext update is used.
The ports install a symlink with the old library version.  When enough
of their dependent ports have had regular updates the remaining ones can
get a PORTREVISION bump and the links can be removed.

Also remove the devel/pcre dependency from USE_GNOME=glib20.  It causes
over 2200 packages to depend on devel/pcre while less than 200 actually
link with it.  The glib20 package still depends on devel/pcre so this
should not make a difference for ports with USE_GNOME=glib20.  Also,
libdata/pkgconfig/glib-2.0.pc lists pcre as a private library so
USE_GNOME=glib20 should not propagate it.

PR:		195724
Exp-run by:	antoine
Approved by:	portmgr (antoine)
60945f0277
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.39.0
- Update to 7.39.0

Changes:	http://curl.haxx.se/changes.html
322f024af4
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.39.0
- Update to 7.39.0

Changes:	http://curl.haxx.se/changes.html
6fc6cda72d
Baptiste Daroussin (bapt) · 7.38.0_2
Clean up plist
1e242b782f
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.38.0_2
- Fix threaded-resolver - Bump PORTREVISION for package change

PR:		ports/193972
Submitted by:	bsduser <local@o2.pl>, mickael.maillot@gmail.com
Obtained by:	https://github.com/bagder/curl/commit/d9762a7cdb35e70f8cb0bf1c2f8019e8391616e1
265a43e434
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.38.0_1
- Fix nghttp2 version requirement - Bump PORTREVISION for www/nghttp2 shlib change
e09781e206
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.38.0
- Update to 7.38.0 - Remove SPNEGO option

Changes:	http://curl.haxx.se/changes.html
c28c0de9cb
Tijl Coosemans (tijl) · 7.37.1_4
dns/libidn: - Add USES=libtool and bump dependent ports - Add INSTALL_TARGET=install-strip - Always install libidn-components.png because it is used by libidn.info - Add -lintl to Libs.private instead of Libs in libidn.pc
f1655c7b7a
Tijl Coosemans (tijl) · 7.37.1_3
dns/c-ares: - Add USES=libtool and bump dependent ports - Move variable definitions in front of include bsd.port.options.mk - Replace patch with USES=pathfix

Approved by:	portmgr (implicit, bump unstaged port)
c8711e099a
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.37.1_2
- Add CPE information
99dd46a1e4
Tijl Coosemans (tijl) · 7.37.1_2
net/openldap24-*: - Convert to USES=libtool and bump dependent ports - Avoid USE_AUTOTOOLS - Don't use PTHREAD_LIBS - Use MAKE_CMD

databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip

databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample

databases/libgdamm:
- Drop :keepla
- USES=tar:bzip2
- Use INSTALL_TARGET=install-strip

databases/libgdamm5:
- Add INSTALL_TARGET=install-strip
- Drop --enable-static (inherited from old repocopy)

devel/anjuta x11-toolkits/py-gnome-extras:
- Drop :keepla

dns/powerdns dns/powerdns-devel:
- Convert to USES=libtool
- Add INSTALL_TARGET=install-strip
- Disable static modules
- Stop creating library symlinks with .0 suffix, not needed for dynamically
  opened modules

mail/dovecot2:
- Add USES=libtool

mail/dovecot2-pigeonhole:
- Drop CONFIGURE_TARGET (incorrect for Dragonfly)
- Add USES=libtool and INSTALL_TARGET=install-strip

math/gnumeric:
- USES=libtool tar:xz

Approved by:	portmgr (implicit, bump unstaged ports)
37f54e0f66
Tijl Coosemans (tijl) · 7.37.1_1
- Replace security/gnutls with security/gnutls3 and update to 3.2.15 - Bump PORTREVISION on all ports that depend on security/gnutls and   adjust all ports that depend on security/gnutls3 - Update mail/anubis to version 4.2 which supports gnutls 3.x - Update mail/libvmime to a development snapshot (recommended by upstream   developers)

PR:		191274
Exp-run by:	antoine
Approved by:	portmgr (antoine)
3ab1b8443e
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.37.1
- Fix build of ftp/curl-hiphop
bbfcce26d7
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.37.1
- Update to 7.37.1

Changes:	http://curl.haxx.se/changes.html
488d1dc484
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.37.0
- Update to 7.37.0 - Use USES=libtool:oldver

Changes:	http://curl.haxx.se/changes.html
83dce38127
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0_1
- Specify ABI version

Submitted by:	tijl
c15071922e
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0_1
- Fix NSS option - Bump PORTREVISION

PR:		ports/189987
Submitted by:	ashish
dad56de5a6
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0
- Cleanup regression-test:
48441443a5
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0
- Fix build failure when SPNEGO option is on
de18099943
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0
- Fix HTTP2 option

Reported by:	many
593d995963
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.36.0
- Update to 7.36.0

Changes:	http://curl.haxx.se/changes.html
a75096fe23
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Add HTTP2 option
d917f0d6fa
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Add security/heimdal and security/krb5 support and corresponding options:   - GSSAPI_BASE for base system (default)   - HEIMDAL_PORT for security/heimdal   - KRB5_PORT for security/krb5

Tested by:	redports
c1275d5660
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Sort PLIST
b7df9d88b2
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Use USES=tar:lzma
8f341259b5
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Remove no-op NTLM option

PR:		ports/186902
Submitted by:	Jeremy Chadwick <jdc@koitsu.org>
9ba32c52bc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.35.0
- Update to 7.35.0

Changes:	http://curl.haxx.se/changes.html
PR:		ports/186557
Exp-run by:	bdrewery
d7eb79165d
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.34.0
- Update to 7.34.0

Changes:	http://curl.haxx.se/changes.html
PR:		ports/185456
Exp-run by:	bdrewery
49b8a762e3
Xin LI (delphij) · 7.33.0_2
Apply vendor fix for CVE-2013-6422, cURL libcurl cert name check ignore with GnuTLS.  Document the vulnerability fix in vuxml while I'm here.
7f12df195a
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.33.0_1
- Use PORTDOCS and PORTEXAMPLES - Simplify Makefile
82c0a28bb1
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.33.0_1
- Strip shared library - Use += for CONFIGURE_ENV
2c7f31627b
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.33.0_1
- Fix build when both GSSAPI and SPNEGO options are on

When SPNEGO option is on, LOCALBASE/include/fbopenssl was added to the search
path of include files. It causes build failure when "#include <gssapi.h>" wants
/usr/include/gssapi/gssapi.h.
3277ab6371
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.33.0_1
- Fix PLIST - Bump PORTREVISION for package change

PR:		ports/183388 [1]
Submitted by:	avilla [1]
Reported by:	antoine
05ad87dfe4
Hiroki Sato (hrs) · 7.33.0
- Split the library part of multimedia/rtmpdump into multimedia/librtmp. - Update ports depending on librtmp. - Add instruction to avoid a build error in multimedia/rtmpdump under a   specific condition.
42bc4e4802
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.33.0
- Update to 7.33.0

Changes:	http://curl.haxx.se/changes.html
PR:		ports/183151
Exp-run by:	bdrewery
0e5c05a56a
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.32.0
- Convert to new LIB_DEPENDS format - Convert to new options helper - Remove --disable-threaded-resolver from CONFIGURE_ARGS, it is handled by THREADED_RESOLVER option
51bc21f9d7
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.32.0
- Add SSP support
10bc648258
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.32.0
- Fix STAGEDIR support

Reported by:	makc
f4b2d5508e
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.32.0
- Update to 7.32.0 - Turn COOKIES on by default - Support STAGEDIR

Note:
- mk-ca-bundle.1 will not be installed. Use http://curl.haxx.se/docs/caextract.html instead

Changes:	http://curl.haxx.se/changes.html
PR:		ports/181510
Exp run by:	drewery
b8e2378484
Baptiste Daroussin (bapt) · 7.31.0_1
Add NO_STAGE all over the place in preparation for the staging support (cat: ftp)
1640537ad6
Bryan Drewery (bdrewery) · 7.31.0_1
SSP support has been added to ports with WITH_SSP for i386 and amd64 on FreeBSD 10, and amd64 on earlier versions.

SSP_UNSAFE is added to disable in a port if it fails to build, but
this should only be used in rare circumstances such as kernel modules.
Otherwise, the port may just be failing due to lack of respecting
LDFLAGS.

On FreeBSD 10, this uses an ldscript in /usr/lib/libc.so to pull in
libssp_nonshared.a to address issues linking on i386 [1].

On earlier FreeBSD versions the WITH_SSP knob will add -lssp_nonshared
to LDFLAGS on i386. This is not needed on amd64. However, several hundred
ports do not currently respect LDFLAGS, so this support is disabled currently
as it causes build failures if a dependency is looking for the stack_chk
symbols.

Many thanks to jlh@ for this as he had many years of patience in getting
all of the necessary pieces [1][2] in.

[1] http://svnweb.freebsd.org/base/head/lib/libc/libc.ldscript?revision=251668&view=markup

PR:		ports/138228 [2]
Submitted by:	jlh (bsd.ssp.mk based on)
Reviewed by:	bapt
With hat:	portmgr
exp-runs done:	37 over a month on 91i386,91amd64,10i386,10amd64
c93dfc2e9f
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0_1
- Disable CFLAGS=-D* check temporarily: workaround for LDAP issue [1] and CPUTYPE [2] - Remove note in pre-configure: since it does not help to avoid bug-report mails

PR:		ports/177401 [1], ports/180648 [1], ports/180944 [2]
a138a63a56
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0_1
- Convert to new perl framework
c9cf6c6113
Alex Kozlov (ak) · 7.31.0_1
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0_1
- Add note about LDAP issue (-DLDAP_DEPRECATED)

PR:		ports/177401
372eccbd8e
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0_1
- Fix ossl_recv() to eliminate false positive OpenSSL errors - Bump PORTREVISION for package change

Submitted by:	Brett Gmoser <bgmoser@leadbidinc.com>, Sergey Lobanov <wmn@siberianet.ru>
Obtained from:	https://github.com/bagder/curl/commit/8a7a277c086199b
Reference:	http://sourceforge.net/p/curl/bugs/1249/
83ce1d5836