Researcher Nicolas Seriot demonstrated that curl versions 8.12 through 8.16 were accidentally Turing-complete by combining unbounded config file slicing and inclusion features to simulate a two-counter Minsky machine. The vulnerability was fixed in curl 8.17.0 by adding a five-level include depth cap, preventing arbitrary computation through config files.
Background
curl is one of the most widely used command-line tools for data transfer over networks. This discovery highlights how feature combinations in complex software can unexpectedly produce computationally powerful behaviors, similar to other recent findings of accidental Turing-completeness in tools like npm or sed.
- Source
- Lobsters
- Published
- Oct 30, 2026 at 03:24 PM
- Score
- 7.0 / 10