News › security
By Zayden R., September 3, 2026
curl 8.22.0 addresses six new CVEs discovered by AISLE after OpenAI and Anthropic found none. These vulnerabilities, rated low severity, highlight the robustness of curl's codebase but require attention from sysadmins.
In a surprising turn of events, the release of curl 8.22.0 comes with fixes for six new CVEs discovered by AISLE, following a period where OpenAI and Anthropic reported zero findings. This news should catch the attention of engineers and sysadmins worldwide, as curl is a ubiquitous tool with over 20 billion deployments, from household smart devices to complex spacecraft systems.
The vulnerabilities identified include CVE-2026-80229, an OpenSSL provider use-after-free, and CVE-2026-80230, an OpenSSL pinning bypass. Other CVEs such as CVE-2026-80231 and CVE-2026-80255 involve native CA store connection reuse and secure attribute bypass with tab, respectively. Additionally, CVE-2026-82208 and CVE-2026-82209 address issues with wolfSSL CA-cache hit overrides callback and domain-scoped public-suffix cookie.
While all six vulnerabilities are rated as low severity, this profile is a testament to curl's exceptional engineering maturity. These issues tend to hide in narrow configurations and subtle interactions, thus limiting their practical impact. Nevertheless, they underscore the importance of continuous security audits, especially in widely used software.
AISLE’s autonomous AI system managed to uncover these vulnerabilities shortly after OpenAI's Codex Security and Anthropic's Mythos reported no findings. This highlights the evolving capabilities of AI in cybersecurity, though it’s worth noting that curl's maintainers independently verified and decided the merit of each finding for a CVE designation.
For sysadmins and engineers, the practical takeaway is clear: ensure systems are updated to curl 8.22.0 to mitigate these vulnerabilities. The updates were officially credited to Stanislav Fort from AISLE, with reports made between August 24 and August 27, 2026. As always, staying on top of security updates remains a critical task in maintaining the integrity of your systems.