How curl was accidentally Turing-complete for nine months
Summary
The article reveals that curl's config include mechanism could encode a two-counter machine, rendering curl Turing-complete under unbounded assumptions. A five-level include cap introduced in 8.17 prevents the reduction. It also covers a PoC for 2+3, runtime bounds, and notes the security impact is none.