25-Year-Old Vulnerability Patched in Curl

A critical authentication bypass vulnerability lurked undetected in the widely-used curl library for over 25 years, underscoring how foundational open-source components can harbor severe flaws across their entire version history. The flaw, enabling improper mTLS connection reuse, could allow attackers to bypass authentication silently — a particularly dangerous condition in environments relying on mutual TLS for strong identity assurance. This case illustrates that longevity in open-source software does not imply security, and that even low-level utility libraries embedded in countless products require structured vulnerability review. The scale of this single release — 18 patches at once — also highlights the risk of deferred security debt accumulating in widely-deployed dependencies.