{"id":30202,"date":"2026-06-26T13:34:00","date_gmt":"2026-06-26T11:34:00","guid":{"rendered":"https:\/\/daniel.haxx.se\/blog\/?p=30202"},"modified":"2026-06-26T14:02:37","modified_gmt":"2026-06-26T12:02:37","slug":"a-curl-mountain-movie","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2026\/06\/26\/a-curl-mountain-movie\/","title":{"rendered":"A curl mountain movie"},"content":{"rendered":"\n

One of my favorite visuals for known vulnerabilities in curl is the mountain<\/em>. It shows how many currently known vulnerabilities were present in the code through-out curl’s history.<\/p>\n\n\n\n

In the end of June 2026 it looks like this:<\/p>\n\n\n

\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n

Over time we get more vulnerabilities reported. Since every flaw has a version range during which the problem existed and with more issues that have overlapping version ranges, the mountain grows. It changes shape every time we do a release or we publish a new vulnerability.<\/p>\n\n\n\n

At this moment in time, curl version 7.34.0<\/a> is the release that contains the most number of known vulnerabilities: 101<\/a>. The worst one ever if you will. Out of a total of 206.<\/p>\n\n\n\n

The mountain uses different colors for different severity levels of the published vulnerabilities, as the legend in the top-left of the image explains.<\/p>\n\n\n\n

To illustrate the ever-changing nature of the shape and size, I wrote a script that renders the mountain<\/em> the way it looked at specific dates in the past up until today. More specifically, the script renders one image for every month since curl started (March 1998). I then turned these 340 individual images into a little movie that shows how it grew into today’s shape. At four months\/second.<\/p>\n\n\n\n

\n