Why Did the 4‑Year Rust Rewrite of curl, 95% Complete, Suddenly Get Abandoned?

curl is the world’s most widely deployed open‑source network transfer tool, installed on over 20 billion devices and maintained by Daniel Stenberg since 1998. Its core library libcurl consists of roughly 180 k lines of C code, comparable in size to the novel War and Peace.

Security analysis shows that half of curl’s publicly disclosed vulnerabilities stem from C‑language mistakes; out of 98 reported bugs, 51 are directly caused by coding errors in C, and memory‑related bugs pose the highest risk.

Although Rust offers strong memory safety and performance, a full rewrite of curl was deemed unrealistic. Stenberg explained that rewriting a mature, heavily used codebase in a new language would introduce many new bugs and require massive time and effort.

Instead, the project adopted a compromise: keep the existing C code but replace the libcurl backend with a Rust‑implemented component based on the Hyper HTTP library. libcurl’s architecture already supports interchangeable backends—up to 13 TLS implementations and integration with 33 third‑party libraries—so swapping the HTTP/1.1 and HTTP/2 engine for Hyper fit naturally.

The effort spanned four years and reached 95 % completion, with most test cases passing on both the original and the new backend.

The abandonment decision was driven by a mismatch between maintenance cost and benefit. The C‑Rust glue layer required for Hyper lacked a stable C binding, leading to 10‑15 failing test cases and incomplete HTTP/2 support, effectively doubling maintenance effort for negligible gains. Additionally, developers proficient in both C and Rust are scarce, and the user community was split: Rust developers prefer the native Hyper library, while traditional curl users have no need for a Hyper backend. Consequently, no one was willing to sustain the new code.

As a result, the Hyper backend was removed, but curl will retain two other Rust‑based backends—rustls for TLS and quiche for QUIC/HTTP‑3—because they integrate more cleanly with libcurl’s API and impose lower maintenance overhead.

Stenberg emphasizes that dropping Hyper does not mean abandoning Rust entirely; the experiment provided valuable lessons, and future curl releases may incorporate additional Rust libraries as backend components. References: Stenberg (2021) on C‑related vulnerabilities, Stenberg (2017) "curl is C", Stenberg (2020) on Rust‑Hyper integration, and Stenberg (2024) announcing the removal of Hyper.