pthread_cancel - It's always DNS!

Updated (2025年09月13日) see “RIP pthread_cancel

Updated (2025年08月22日) at the end

You probably know about threads and most likely heard of pthreads, but have you ever used pthread_cancel()? Well, I had not before last week and it was a little bit of a journey.

What’s the problem?

curl (or better libcurl) runs all transfers in the same thread (You can run libcurl in several threads, but that’s a story for another post).

read more

Apache ACME ARI

With mod_md v2.6.0 the Apache ACME in httpd supports the new “ARI” extension. This is described in rfc9773 titled “ACME Renewal Information (ARI) Extension”. What does that mean?

An ACME CA, like Let’s Encrypt, can publish an API endpoint where a client can ask it about a certificate renewal. This can be seen in the “directory” of the server. Like this:

> curl https://acme-v02.api.letsencrypt.org/directory
{
 "-S7Ve8oLIfo": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
 "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
 "meta": {
 "caaIdentities": [
 "letsencrypt.org"
 ],
 "profiles": {
 "classic": "https://letsencrypt.org/docs/profiles#classic",
 "shortlived": "https://letsencrypt.org/docs/profiles#shortlived (not yet generally available)",
 "tlsserver": "https://letsencrypt.org/docs/profiles#tlsserver"
 },
 "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf",
 "website": "https://letsencrypt.org"
 },
 "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
 "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
 "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
 "renewalInfo": "https://acme-v02.api.letsencrypt.org/acme/renewal-info",
 "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}

The ARI endpoint is seen here at renewalInfo. Asking that URL, you’ll get:

read more

HPACK Bombing Apache

Let’s talk a bit about CVE-2025-53020, a moderate security vulnerability in Apache httpd that was fixed with the recent release 2.4.64. It was found by security researcher Gal Bar Nahum and reported to the project on June 18th 2025.

Gal did real real research, understanding the protocol, reading our code and spotting where a client could pierce through our defenses. What you’d expect from a real security researcher. Not one of the new AI sloppers clogging projects everywhere.

read more

curl platform performance

curl being used on many platforms, I looked at how my recent improvements compared on my linux (debian sid) box.

Yes, I did, but not as much. Below are the numbers for running 50000 requests of a 10KB resource on localhost, using a single HTTP/2 connection with 100 concurrent transfers. These are requests per second:

Curl Request Scorecard MacOS vs Linux

8.14.1 is the most recent version we shipped. The second row is the current master with the improved “data_pending” handling I wrote about. The third row is the latest improvement that is currently a PR with some bike-shedding about the option name.

read more

curl request performance

Let’s make curl a little bit faster!

When I looked at curl Flame Graphs last Friday, I noticed something that deserved my attention. The graph below was made with curl’s scorecard.py, a tool for running several performance related scenarios against a curl build. I called it via

> python3 tests/http/scorecard.py -r --request-count=50000 --request-parallels=100 h2
Date: 2025年06月30日T07:47:36.380050+00:00
Version: curl 8.15.0-DEV (x86_64-apple-darwin24.5.0) libcurl/8.15.0-DEV OpenSSL/3.5.0 zlib/1.2.12 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.7 libpsl/0.21.5 nghttp2/1.65.0 ngtcp2/1.12.0 nghttp3/1.10.1 librtmp/2.3 libgsasl/2.2.2
Features: alt-svc AsynchDNS brotli gsasl HSTS HTTP2 HTTP3 HTTPS-proxy HTTPSRR IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets zstd
Samples Size: 1
Requests in parallel to httpd/2.4.64
 size total 100 max [cpu/rss]
 10KB 50000 9486 r/s [89.6%/23MB]

This does 50k requests over a single HTTP/2 connection for a 10KB resource with 100 in parallel at a time. The result then tells it did 9486 requests per second, using 89% user CPU and 24 MB of memory. That’s not bad.

read more