I read the new #openssl advisory several times and I can't tell if #curl is affected.

This advisory was unusually vague and badly written.

Since #openssl does not seem to fix any of the remaining #QUIC API problems in their upcoming 3.4 release, it will keep lagging behind.

https://openssl-library.org/post/2024-08-16-3.4-alpha-approaching/

According to @bagder the stubborn way the #OpenSSL project is handling #QUIC implementation is directly responsible for delaying HTTP/3 adoption (1), and I tend to agree. When the project rejected the community QUIC patches and decided to go with their own design, it wasn't difficult to predict problems. This was proven right by the massive feature gaps (2) and performance issues (3) discovered by @icing when trying to marry OpenSSL QUIC to #curl. Even with API fixes released in version 3.3 the implementation is still inferior, and there is no good solution in sight.

1) https://lwn.net/Articles/983380/
2) https://github.com/openssl/openssl/discussions/23339
3) https://github.com/icing/blog/blob/main/curl-h3-performance.md

blog/curl-h3-performance.md at main · icing/blog

Contribute to icing/blog development by creating an account on GitHub.

^GitHub

I could not resist responding to the #openssl thread on #lwn:

https://lwn.net/Articles/983380/