How curl was accidentally Turing-complete for nine months

The vulnerability existed from curl 8.12 through 8.16, where config files could slice variable values and include other config files without an explicit depth cap. Together, these features allowed curl to simulate any two-counter Minsky program.

Under the usual idealization of unbounded strings and resources, this construction made curl Turing-complete. The issue was discovered and reported by researcher Nicolas Seriot.

Fix Applied

Curl 8.17.0 addressed this vulnerability by implementing a five-level include cap that breaks the reduction to Turing-completeness.