CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

ftp/curl 8.23.0

Command line tool and library for transferring data with URLs

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 8.23.0
Upstream
up to date
Last update
to 8.23.0 · 1c19f23423
Quarterly
2026Q4: 8.23.0 · last MFH 0b6d7a71f4
WWW
https://curl.se/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install curl
installs 8.23.0 from latest; from quarterly (2026Q4) 8.23.0
Port
# cd /usr/ports/ftp/curl && make install clean
# make -C /usr/ports/ftp/curl config  # change options first
Size
1.9 MiB download · 5.7 MiB installed
Depends on
archivers/brotli 1.2.1,1, archivers/zstd 1.5.7_2, dns/libidn2 2.3.8, dns/libpsl 0.23.3, security/libssh2 1.11.1_1,3, www/libnghttp2 1.70.0
License
MIT
Options
30 of 40 on in the package: ALTSVC BROTLI COOKIES DICT DOCS EXAMPLES FTP GOPHER GSSAPI_BASE HTTP HTTP2 IDN IMAP IPFS IPV6 LIBSSH2 MQTT NTLM OPENSSL POP3 PROXY PSL RTSP SMTP STATIC TELNET TFTP THREADED_RESOLVER WEBSOCKET ZSTD
Show the 10 options that are off
CARES DEBUG GNUTLS GSSAPI_MIT GSSAPI_NONE LDAP LDAPS LIBSSH LIBUV WOLFSSL

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 168.23.08.22.0–
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 158.23.08.22.0–
FreeBSD 148.23.08.22.08.23.0

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 8.23.0.

Fixed (55)

Show 55 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298586maintainer-feedback? ftp/curl: support Rustls for TLSNew2026-09-18
297733maintainer-feedback? ftp/curl: Multiple options are missing IMPLIESNew2026-08-22
297732maintainer-feedback? ftp/curl: Multiple options are missing dependencies for unit testsNew2026-08-22
294115maintainer-feedback? ftp/curl: Incorrect dependency for libssh and libssh2 after b889b19eb5e30e1c77d57d0e43977b4af9a0cbb5New2026-05-15
288123maintainer-feedback? ftp/curl: Add HTTP/3 Support (preliminary diff)New2026-04-08

Commits (435)

Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0
- Fix build when security/openssl is installed - Pet portlint
fa34a754b3
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0
- Fix typo

Submitted by:	Herbert J. Skuhra <hskuhra@eumx.net>
ea8e1d0aa0
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.31.0
- Update to 7.31.0 - Bump PORTREVISION for ftp/curl shlib change - Add TEST_DEPENDS - Convert to new options framework - Adjust options:   - Add COOKIES   - Add CYASSL, NSS, POLARSSL, THREADED_RESOLVER, TLS_SRP [1]   - Add GSSAPI and SPNEGO [2]   - Remove KERBEROS4   - Rename LIBIDN to IDN   - Remove TRACKMEMORY [1] - Sort option handler - Add SLAVEDIRS: ftp/curl-hiphop - Cosmetic change - Cleanup

Changes:	http://curl.haxx.se/changes.html
PR:		ports/172325 (-exp run), ports/177369 (based on) [1]
Submitted by:	Hirohisa Yamaguchi <umq@ueo.co.jp> [1], hrs (via email) [2]
Exp run by:	miwi
c2d1a14c7c
Xin LI (delphij) · 7.24.0_4
Fix CVE-2013-2174 for ftp/curl with a patch from vendor for now so that users can build the port, per popular demands on mailing list.

The upgrade patch found in ports/172325 is currently under
exp-run.  The changes in this commit against ftp/curl can be
safely reverted before applying that patch, as it's shipped
with new curl release.

Approved by:	portmgr (miwi)
a4c3e0313f
Bryan Drewery (bdrewery) · 7.24.0_3
- Bump PORTREVISION for c-ares update. I had thought this was done   and that the shlib change was missed. I was looking at the wrong   port log.

Reported by:	miwi
fd4f159a1d
Bryan Drewery (bdrewery) · 7.24.0_2
- Chase c-ares shlib update by removing the version
61421acf03
Baptiste Daroussin (bapt) · 7.24.0_2
Convert left unconverted ports in ftp to new options framework
1933bfac59
Eitan Adler (eadler) · 7.24.0_2
This changes almost all the "gnomehack" only USE_GNOME cases to USES= pathfix.

If a port used other USE_GNOME items it was untouched.
The ports that used other USES were fixed by hand.

PR:		ports/177081
Reviewed by:	bapt
Approved by:	portmgr (miwi)
334eb0fc61
Roman Bogorodskiy (novel) · 7.24.0_2
- Add UPDATING entry for gnutls update - Chase shlib version bump for dependant ports
91e365d630
Steve Wills (swills) · 7.24.0_1
- Fix plist issue with slave curl-hiphop caused by last commit

Reported by:	pointyhat (via beat)
Pointyhat to:	swills
29a4e3b49b
Steve Wills (swills) · 7.24.0_1
- Install the autoconf file for libcurl

PR:		ports/171260
Approved by:	maintainer timeout (sunpoet, >2 weeks)
2537df4652
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.24.0
- Prepare for slave port ftp/curl-hiphop

PR:		ports/169946
Submitted by:	mm
2ba65fd878
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.24.0
- Update to 7.24.0

Changes:	http://curl.haxx.se/changes.html
49641faa1b
Sunpoet Po-Chuan Hsieh (sunpoet) · 7.21.3_2
- Take maintainership

Approved by:	roam (maintainer, implicit)
1ac8aec33d
Martin Wilke (miwi) · 7.21.3_2
- Remove WITH_FBSD10_FIX, is no longer needed
e1c6649edf
Beat Gaetzi (beat) · 7.21.3_2
- Fix build on FreeBSD 10

Approved by:	portmgr (miwi)
542da4442b
Dmitry Marakasov (amdmi3) · 7.21.3_2
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Roman Bogorodskiy (novel) · 7.21.3_2
Chase security/gnutls update and add an UPDATING entry.
207386f96a
Wen Heping (wen) · 7.21.3_1
- Bump PORTREVISION to chase the update of dns/libidn
43721c23d5
Peter Pentchev (roam) · 7.21.3
Update cURL to 7.21.3 and fix its librtmp detection.  In the process: - disable the -Werror build option by popular demand - do not override the user's debug and optimization settings

PR:		150854 (the debug and optimization CFLAGS)
Reported by:	Anonymous <swell.k@gmail.com>
6387b07b2f
Peter Pentchev (roam) · 7.21.1
Update to curl-7.21.1; in the process: - add a knob for the compiler's -Werror checking, on by default - add a knob for RTMP streams support - reflect reality: actually disable the diagnostic memory tracking   if the user has turned the knob off! - fix a bashism in the configure script - remove two patches to the test framework that were integrated upstream
8a7e06be2a
Gabor Pali (pgj) · 7.20.1
- Make run dependency on security/ca_root_nss optional

PR:		ports/149368
Submitted by:	pgj
Approved by:	roam (maintainer timeout)
989719bbe3
Peter Pentchev (roam) · 7.20.1
Update to curl-7.20.1 and specify the MIT license.
14d10152d6
Peter Pentchev (roam) · 7.20.0
Update to curl-7.20.0.
130db9c13e
Peter Pentchev (roam) · 7.19.7_1
Now that c-ares-1.7.0 is in the tree, cURL can, at long last, use c-ares for asynchronous DNS lookups while supporting IPv6!
b51eb0f94c
Peter Pentchev (roam) · 7.19.7_1
Fix the build of dependent ports by including <sys/select.h> on earlier FreeBSD versions.  I've modified the PR patch slightly to make it a bit more portable so it was suitable for forwarding upstream :) Bump PORTREVISION.

PR:		141459
Submitted by:	garga
4333c0727c
Peter Pentchev (roam) · 7.19.7
Remove a minor patch to the testing subsystem resulting in a brain lapse on my part.  It's just not needed, the code flows otherwise here, as kindly pointed out by Daniel Stenberg, the cURL upstream author. No PORTREVISION bump - no change to the binary package, no change even to the standard build, the tests must be invoked explicitly.
28c45b43ae
Peter Pentchev (roam) · 7.19.7
Update to curl-7.19.7.
997b0e4233
Dmitry Marakasov (amdmi3) · 7.19.6_1
- Switch SourceForge ports to the new File Release System: categories starting with E,F
c6d73b3a64
Roman Bogorodskiy (novel) · 7.19.6_1
Bump PORTREVISIONs of the gnutls dependant ports to chase gnutls update.
f32c11d872
Peter Pentchev (roam) · 7.19.6
Update the cURL port to 7.19.6.
46fc00827b
Peter Pentchev (roam) · 7.19.5_1
Well, yeah, leave it to me to test an update and all dependent ports, notify maintainers, wait for a couple of days, and then only commit the update itself, leaving the dependent ports un-updated :(

Bump the shared lib dependency on ports touched by the c-ares update.

Pointy hat to:	roam (myself)
8e58200b71
Peter Pentchev (roam) · 7.19.5
Update to curl-7.19.5.
4f0eea31eb
Pav Lucistnik (pav) · 7.19.4
- Mark MAKE_JOBS_SAFE

PR:		ports/133003
Submitted by:	mm
Approved by:	maintainer timeout (roam; 1 month)
52c68fb695
Peter Pentchev (roam) · 7.19.4
Update to curl-7.19.4, which fixes a redirection vulnerability. The changes in the patch files are almost the same as in Eugene's PR, although I arrived at them mostly independently :) Reformat all patch files now that I use quilt to manage them. Fix two complaints from portlint: needless use of CFLAGS and differentiation between NOPORTDOCS and NOPORTEXAMPLES.  Thanks, Eugene!

PR:		132358
Submitted by:	Eygene Ryabinkin <rea-fbsd@codelabs.ru>
1ec0906e49
Peter Pentchev (roam) · 7.19.2
Apply a band-aid to fix the build without proxy support. Note that some of the tests shall fail for the present.
bd3c754a8f
Peter Pentchev (roam) · 7.19.2
At long last, update the curl port to its almost-current version, 7.19.2. Yes, there's been a new 7.19.3 version for a couple of days now, but I figure you folks have been waiting for me much too much as it is :( Apologies all around!

Prompted by:	several PR's and more people (and portmgrs) than I dare admit
decc454be4
Rong-En Fan (rafan) · 7.18.0
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk
 - Remove CONFIGURE_TARGET hack in various bsd.*.mk
 - USE_GNOME=gnometarget is now an no-op

Changes to individual ports, other than removing the CONFIGURE_TARGET hack:

= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
  - comms/gnuradio
  - science/abinit
  - science/elmer-fem
  - science/elmer-matc
  - science/elmer-meshgen2d
  - science/elmerfront
  - science/elmerpost

= use x86_64 as ARCH
  - devel/g-wrap

= other changes
  - print/magicfilter
    GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf

Total # of ports modified:  1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)

PR:		126524 (obsoletes 52917)
Submitted by:	rafan
Tested on:	two pointyhat 7-amd64 exp runs (by pav)
Approved by:	portmgr (pav)
741aa71483
Peter Pentchev (roam) · 7.18.0
Argh.  The cURL build requires Perl.

PR:		123050
Reported by:	Chess Griffin <chess@chessgriffin.com>
Pointy hat to:	roam (myself)
aac3e7428c
Peter Pentchev (roam) · 7.18.0
Update to curl-7.18.0.
abfce57eb5
Roman Bogorodskiy (novel) · 7.16.3_1
- Chase security/gnutls shlib version bump - Add an entry to UPDATING
c9536f39b3
Peter Pentchev (roam) · 7.16.3
Update to curl-7.16.3. Fix the (still present in 7.16.3) libssh2 problems, at least so that cURL works with the libssh2 0.17 in our ports tree.

PR:		114215 (the basic update)
Submitted by:	pesho.petrov@gmail.com
a1b3dc444b
Rong-En Fan (rafan) · 7.16.1_1
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script   supports them.  This is determined by running ``configure --help'' in   do-configure target and set the shell variable _LATE_CONFIGURE_ARGS   which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable   Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - 

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
f935a609c5
Peter Pentchev (roam) · 7.16.1_1
Actually, at least this version of cURL sometimes breaks with the new libssh2, and fails to connect.  Mark the libssh2 usage as broken until I figure out what is the matter.  And yep, David Thiel did inform me in advance about his plans to update libssh2, and I did not check then.
f95a16eebf
Pav Lucistnik (pav) · 7.16.1_1
- Chase libssh2 update

PR:		ports/114474
Submitted by:	Vaclav Haisman <v.haisman@sh.cvut.cz>
Pointy hat to:	lx
8904a74b06
Roman Bogorodskiy (novel) · 7.16.1_1
Chase gnutls shared library version chase: adjust DEPENDS lines and bump PORTREVISIONs.
95eecf16e6
Peter Pentchev (roam) · 7.16.1
Update to curl 7.16.1, loosely based on the PR.  Also: - add a LIBSSH2 option for SCP and SFTP support using security/libssh2; - add a patch from the cURL CVS repository to fix an expired cookie in   test 62.

PR:		109670
Submitted by:	Eygene Ryabinkin <rea-fbsd@codelabs.ru>
fbac954496
Roman Bogorodskiy (novel) · 7.16.0_1
- Chase security/gnutls update - Add an entry to UPDATING - Pet portlint(1) for some ports while I'm here
3d0dcc46ab
Peter Pentchev (roam) · 7.16.0
Update the ftp/curl port to 7.16.0. Bump PORTREVISION of all dependent ports. Fix the build errors in the few ports that still use the long deprecated, and now obsoleted, cURL options.

Thanks to everyone who took the time to look over the patch!

Discussed on:	-ports
64e068d25c
Peter Pentchev (roam) · 7.15.5_1
If c-ares support is requested, properly depend on the shared c-ares library now that dns/c-ares installs it.  This should, among other things, fix the build of libcurl on amd64.

Reported by:	girgen
1f917e575e