Getty Images/iStockphoto

News

Historic Curl flaw shows AI risk to legacy supply chain

An AI audit of Curl unearthed a 25-year-old authentication flaw in code powering 20 billion devices, proving heavily scrutinized legacy libraries still harbor hidden risks.

Craig Galbraith
By
Published: 14 Oct 2026

Enterprise security teams have long assumed that the more widely deployed and heavily scrutinized an open-source library is, the less likely it is to harbor fundamental flaws. The conclusion of a yearlong AI code audit of Curl shatters that assumption.

On Oct. 14, Curl maintainers released version 8.23.0, fixing 24 total security vulnerabilities -- 18 of which stem from an extended AI-powered audit by security firm Aisle. Across the entire engagement, Aisle's models unearthed 35 CVEs and 160 bugs.

Chief among the security firm's discoveries was CVE-2026-8932, a 25-year-old authentication bypass lurking in Curl's connection pool since February 2001 that had survived decades of manual code reviews, static analysis, and bug bounties.

For enterprise security teams, the release is an immediate reminder to check whether affected versions of Curl are running across their environments. However, it's also a stark reminder that as AI drastically lowers the cost of vulnerability discovery, deep open-source dependencies long assumed to be 'battle-tested' can no longer hide behind their age.

Hidden debt in the network stack

Curl develops and secures software that runs on more than 20 billion devices. Curl and its underlying Libcurl library handle data transfers across networks and are embedded in software ranging from operating systems and cloud services to network appliances, making vulnerabilities in the project a potential concern across the enterprise software supply chain.

In its yearlong audit of Curl, the most surprising discovery was a vulnerability hidden in the software for 25 years. Introduced in February 2001, the flaw (CVE-2026-8932) stems from how Libcurl reused cached connections when an application changed client credentials or mTLS configurations. Under specific conditions, an attacker could hijack an existing connection pool entry to bypass authentication controls and execute requests under another user's identity.

Beyond authentication bypasses, Aisle's audit revealed flaws that could allow server impersonation, cause transfers to inadvertently inherit security settings from prior sessions and allow requests to persist using revoked credentials.

Curl founder and CEO Daniel Stenberg, who suspended the project's bug bounty program at the beginning of 2026, had grown increasingly skeptical of the quality of reports he was getting. The program had paid out more than $100,000 for 87 confirmed vulnerabilities over the past seven years.

However, the validation of Aisle’s audit findings marked a turning point.

"The key takeaway [of the report] is that modern AI-powered code analyzers find flaws in ways nothing did previously," he told TechTarget. "The challenge now is how to deal with all of the findings and fix them."

The visibility blind spot

For enterprise security teams, the challenge goes beyond keeping up with newly discovered vulnerabilities. They also need to know where the affected utilities are running across their environment.

James Morrison, security sales strategist at Dataprise and a former CISO and FBI cyber investigator, says organizations often lack that visibility due to shadow IT, when employees introduce unsanctioned software or developers incorporate open-source code into larger projects.

"Because of the nature of shadow IT, if the corporate security team does not have visibility across the enterprise, the unknown software and its vulnerability are only found when the vulnerability is exploited," Morrison said.

The problem doesn't end when an audit identifies a vulnerability. Morrison noted that organizations often put off patching less serious vulnerabilities, then fail to revisit those decisions as new threats emerge. He recommends taking a fresh look at vulnerabilities with each scan rather than assuming flaws previously considered minor remain low risk.

"I have found it best to delete all preconceptions from previous periodic scans and treat every vulnerability found as if it was a brand-new vulnerability," Morrison said.

Artificial intelligence can help by connecting newly disclosed vulnerabilities with current threat information to identify flaws that may pose a greater risk than companies initially realized, he said.

Race to remediation

Detecting the connection pool vulnerability required analyzing dynamic behavior that traditional static analysis tools routinely miss. Stan Fort, founder, chief scientist and CTO at Aisle, says the bug only appeared when the software was used in a particular way, making it more difficult for conventional testing to catch it.

To filter out AI-generated false positives, Aisle tested each potential vulnerability against the current code and assessed its impact. Then the company had a security researcher review the findings. After that, Curl's own security team independently reproduced the reports and decided which warranted CVEs.

As AI models scale vulnerability research, the fundamental challenge for software maintainers and enterprise defenders is shifting from finding bugs to triaging them.

"As discovery becomes cheaper, the main constraint will be validating and fixing findings quickly enough," Fort said.

For Stenberg, the yearlong audit marks a permanent shift in software maintenance and open-source security governance.

"The tables have turned," he said. "In the past, finding each flaw was a slow and hard process only done by a few skilled humans."

Dig Deeper on Threats, Cyberattacks & Vulnerabilities