Curl was accidentally Turing-complete for nine months

From curl 8.12 through 8.16, configuration files could expand and reassign variables, slice values by byte position, and recursively include other config files without a depth limit. These features can encode a two-counter Minsky machine: represent each counter as a string of x characters, use assignments to add or remove a character, and use slicing to test whether a counter is zero. Config-file names represent program states, while expansion selects the next state. This makes curl Turing-complete under the idealized assumptions of unlimited string size and execution. A four-file demonstration performs the calculation 2 + 3, producing five x characters for one register and an empty second register.

Real curl builds could not run such programs indefinitely. Each expansion was limited to 10 million bytes, recursive includes consumed C stack space and kept files open, and a minimal countdown loop on an 8 MB stack crashed after 922 steps. Reassignments also retained old variable versions, increasing memory use and lookup costs. Curl 8.17.0, released in November 2025, added a five-level include cap that blocks the construction; the change was intended to stop endless self-inclusion. Variables first appeared in curl 8.3, and byte-range assignment arrived in 8.12. Bash can supply repeated execution around curl, but then the computation depends on the combination, not curl alone. The discovery has no security impact.