---
id: 1696
title: "cURL audit: How a joke led to significant findings"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/"
published_at: "2023-02-14T13:00:14Z"
tags: ["vulnerability-research", "fuzzing", "memory-corruption", "curl", "trail-of-bits", "libcurl", "afl-plus-plus"]
phying_url: "https://phying.com/item/1696"
lang: en
---

# cURL audit: How a joke led to significant findings

## Summary

Trail of Bits' 2022 cURL audit fuzzed the CLI with AFL++, uncovering CVE-2022-42915 and CVE-2022-43552 plus use-after-free and memory-leak bugs fixed in cURL 7.86.0/7.87.0.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2023-02-14T13:00:14Z
- **Original:** https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
- **Phying News:** https://phying.com/item/1696