curl 8.17.0

curl / Docs / Releases / Changes in 8.17.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.16.0 all changes 8.18.0 🠲

Changes in 8.17.0 - November 5 2025

8.17.0 8.17.0 Changes:

• build: drop Heimdal support
• build: drop the winbuild build system
• krb5: drop support for Kerberos FTP
• libssh2: up the minimum requirement to 1.9.0
• multi: add notifications API
• progress: expand to use 6 characters per size
• ssl: support Apple SecTrust configurations
• tool_getparam: add --knownhosts
• vssh: drop support for wolfSSH
• wcurl: import v2025.11.04
• write-out: make %header{} able to output all occurrences of a header Bugfixes:
• ares: fix leak in tracing
• asyn-ares: remove wrong comment about the callback argument
• asyn-ares: use the duped hostname pointer for all calls
• asyn-thrdd resolver: clear timeout when done
• asyn-thrdd: drop pthread_cancel
• autotools: add support for libgsasl auto-detection via pkg-config
• autotools: capitalize Rustls in the log output
• autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
• autotools: fix duplicate UNIX and BSD flags in buildinfo.txt
• autotools: fix silly mistake in clang detection for buildinfo.txt
• autotools: make --enable-code-coverage support llvm/clang
• autotools: merge ifs in GnuTLS/OpenSSL feature detection
• aws-lc: re-enable large read-ahead with v1.61.0 again
• base64: accept zero length argument to base64_encode
• build: address some -Weverything warnings, update picky warnings
• build: avoid overriding system open and stat symbols
• build: avoid overriding system symbols for fopen functions
• build: avoid overriding system symbols for socket functions
• build: show llvm/clang in platform flags and buildinfo.txt
• c-ares: when resolving failed, persist error
• cf-h2-proxy: break loop on edge case
• cf-ip-happy: mention unix domain path, not port number
• cf-socket: always check Curl_cf_socket_peek() return code
• cf-socket: check params and remove accept procondition
• cf-socket: make set_local_ip void, and remove failf()
• cf-socket: set FD_CLOEXEC on all sockets opened
• cf-socket: tweak a memcpy() to read better
• cf-socket: use the right byte order for ports in bindlocal
• cfilter: unlink and discard
• cfilters: check return code from Curl_pollset_set_out_only()
• checksrc: allow disabling warnings on FIXME/TODO comments
• checksrc: catch banned functions when preceded by (
• checksrc: fix possible endless loop when detecting BANNEDFUNC
• checksrc: fix possible endless loops in the banned function logic
• checksrc: fix to handle ) predecing a banned function
• checksrc: reduce directory-specific exceptions
• CI.md: refresh
• cmake/FindGSS: dedupe pkg-config module strings
• cmake/FindGSS: drop wrong header check for GNU GSS
• cmake/FindGSS: fix pkg-config fallback logic for CMake <3.16
• cmake/FindGSS: simplify/de-dupe lib setup
• cmake/FindGSS: whitespace/formatting
• cmake: add and use local FindGnuTLS module
• cmake: add CURL_CODE_COVERAGE option
• cmake: build the "all" examples source list dynamically
• cmake: clang detection tidy-ups
• cmake: drop exclamation in comment looking like a name
• cmake: fix HAVE_GNUTLS_SRP detection after adding local FindGnuTLS module
• cmake: fix building docs when the base directory contains .3
• cmake: fix Linux pre-fill HAVE_POSIX_STRERROR_R (when _CURL_PREFILL=ON)
• cmake: fix Linux pre-fills for non-glibc (when _CURL_PREFILL=ON)
• cmake: minor Heimdal flavour detection fix
• cmake: pre-fill three more type sizes on Windows
• cmake: say 'absolute path' in option descriptions and docs
• cmake: support building some complicated examples, build them in CI
• cmake: use modern alternatives for get_filename_component()
• cmake: use more COMPILER_OPTIONS, LINK_OPTIONS / LINK_FLAGS
• cmdline-docs: extended, clarified, refreshed
• cmdline-opts/_PROGRESS.md: explain the suffixes
• configure: add "-mt" for pthread support on HP-UX
• conn: fix hostname move on connection reuse
• conncache: prevent integer overflow in maxconnects calculation
• connect: for CONNECT_ONLY, CURLOPT_TIMEOUT does not apply
• connect: remove redundant condition in shutdown start
• cookie: avoid saving a cookie file if no transfer was done
• cookie: only count accepted cookies in Curl_cookie_add
• cookie: remove the temporary file on (all) errors
• cpool: make bundle->dest an array; fix UB
• curl.h: remove incorrect comment about CURLOPT_PINNEDPUBLICKEY
• curl_easy_getinfo: error code on NULL arg
• curl_easy_setopt.md: add missing CURLOPT_POSTFIELDS
• curl_mem_undef.h: limit to CURLDEBUG for non-memalloc overrides
• curl_ngtcp2: fix -Wunreachable-code with H3 !verbose !unity clang
• curl_osslq: error out properly if BIO_ADDR_rawmake() fails
• curl_path: make sure whitespace-only is illegal
• Curl_resolv: fix comment. 'entry' argument is not optional
• curl_slist_append.md: clarify that a NULL pointer is not acceptable
• curl_threads: delete WinCE fallback branch
• CURLINFO_FTP_ENTRY_PATH.md: this is for SFTP as well
• CURLOPT_COOKIEFILE.md: clarify when the cookies are loaded
• CURLOPT_COPYPOSTFIELDS.md: used with MQTT and RTSP as well
• CURLOPT_HEADER/WRITEFUNCTION.md: drop '* size' since size is always 1
• CURLOPT_MAXLIFETIME_CONN: make default 24 hours
• CURLOPT_POSTFIELDSIZE*: these also work for MQTT and RTSP
• CURLOPT_SERVER_RESPONSE_TIMEOUT*: add default and see-also
• CURLOPT_SSL_VERIFYHOST.md: add see-also to two other VERIFYHOST options
• CURLOPT_TIMECONDITION.md: works for FILE and FTP as well
• cw-out: fix EAGAIN handling on pause
• cw-out: unify the error handling pattern in cw_out_do_write
• digest_sspi: fix two memory leaks in error branches
• dist: do not distribute CI.md
• docs/cmdline-opts: drop double quotes from GLOBBING and URL examples
• docs/libcurl: clarify some timeout option behavior
• docs/libcurl: remove ancient version references
• docs/libcurl: use lowercase must
• docs: expand on quoting rules for filenames in SFTP quote
• docs: fix/tidy code fences
• doh: cleanup resources on error paths
• doswin: CloseHandle the thread on shutdown
• easy_getinfo: check magic, Curl_close safety
• ECH.md: make OpenSSL branch clone instructions work
• examples/chkspeed: portable printing when outputting curl_off_t values
• examples/http2-serverpush: fix file handle leaks
• examples/sessioninfo: cast printf string mask length to int
• examples/sessioninfo: do not disable security
• examples/synctime: fix null-termination assumptions
• examples/synctime: make the sscanf not overflow the local buffer
• examples/usercertinmem: avoid stripping const
• examples/websocket: fix use of uninitialized rlen
• examples: call curl_global_cleanup() where missing
• examples: check more errors, fix cleanups, scope variables
• examples: drop unused curl/mprintf.h includes
• examples: fix build issues in 'complicated' examples
• examples: fix more potential resource leaks, and more
• examples: fix two build issues surfaced with WinCE
• examples: fix two issues found by CodeQL
• examples: fix two more cases of stat() TOCTOU
• examples: improve global init, error checks and returning errors
• examples: replace casts with curl_off_t printf masks
• examples: return curl_easy_perform() results
• firefox-db2pem.sh: add macOS support, tidy-ups
• form.md: drop reference to MANUAL
• ftp: add extra buffer length check
• ftp: check errors on remote ip for data connection
• ftp: fix ftp_do_more returning with *completep unset
• ftp: fix port number range loop for PORT commands
• ftp: fix the 213 scanner memchr buffer limit argument
• ftp: improve fragile check for first digit > 3
• ftp: reduce size of some struct fields
• ftp: remove 'newhost' and 'newport' from the ftp_conn struct
• ftp: remove misleading comments
• ftp: remove the retr_size_saved struct field
• ftp: remove the state_saved struct field
• ftp: replace strstr() in ;type= handling
• ftp: simplify the 150/126 size scanner
• gnutls: check conversion of peer cert chain
• gnutls: fix re-handshake comments
• gssapi: make channel binding conditional on GSS_C_CHANNEL_BOUND_FLAG
• gtls: avoid potential use of uninitialized variable in trace output
• gtls: check the return value of gnutls_pubkey_init()
• header.md: see-also --proxy-header and vice versa
• hmac: free memory properly on errors
• hostip: don't store negative resolves due unrelated errors
• hostip: fix infof() output for non-ipv6 builds using IPv6 address
• hostip: remove leftover INT_MAX check in Curl_dnscache_prune
• http2: check push header names by length first
• http2: cleanup pushed newhandle on fail
• http2: ingress handling edge cases
• HTTP3: clarify the status for "old" OpenSSL, not current
• http: check the return value of strdup
• http: fix -Wunreachable-code in !websockets !unity builds
• http: fix -Wunused-variable in !alt-svc !proxy !ws builds
• http: handle user-defined connection headers
• http: look for trailing 'type=' in ftp:// without strstr
• http: make Content-Length parser more WHATWG
• http: only accept ';' as a separator for custom headers
• http: return error for a second Location: header
• http_aws_sigv4: check the return value of curl_maprintf()
• http_proxy: fix adding custom proxy headers
• httpsrr: free old pointers when storing new
• httpsrr: send HTTPS query to the right target
• imap: fix custom FETCH commands to handle literal responses
• imap: parse and use UIDVALIDITY as a number
• imap: treat capabilities case insensitively
• INSTALL-CMAKE.md: add manual configuration examples
• INSTALL-CMAKE.md: document useful build targets
• INSTALL-CMAKE.md: fix descriptions for LDAP dependency options
• INSTALL: update the list of known operating systems
• INTERNALS: drop Winsock 2.2 from the dependency list
• ip-happy: do not set unnecessary timeout
• ip-happy: prevent event-based stall on retry
• kerberos: bump minimum to 1.3 (2003-07-08), drop legacy logic
• kerberos: drop logic for MIT Kerberos <1.2.3 (pre-2002) versions
• kerberos: stop including gssapi/gssapi_generic.h
• krb5: fix output_token allocators in the GSS debug stub (Windows)
• krb5: return appropriate error on send failures
• krb5_gssapi: fix memory leak on error path
• krb5_sspi: the chlg argument is NOT optional
• ldap: avoid null ptr deref on failure
• ldap: do not base64 encode zero length string
• ldap: do not pass a \n to failf()
• ldap: tidy-up types, fix error code confusion
• lib1514: fix return code mixup
• lib: delete unused crypto header includes
• lib: drop unused include and duplicate guards
• lib: fix build error with verbose strings disabled
• lib: remove newlines from failf() calls
• lib: remove personal names from comments
• lib: SSL connection reuse
• lib: stop NULL-checking conn->passwd and ->user
• lib: upgrade/multiplex handling
• libcurl-multi.md: added curl_multi_get_offt mention
• libcurl-security.md: mention long-running connections
• libssh/libssh2: reject quote command lines with too much data
• libssh/sftp: fix resume corruption by avoiding O_APPEND with rresume
• libssh2/sftp: fix resume corruption by avoiding O_APPEND with rresume
• libssh2/sftp_realpath: change state consistently
• libssh2: avoid risking using an uninitialized local struct field
• libssh2: bail out on chgrp and chown number parsing errors
• libssh2: clarify that sshp->path is always at least one byte
• libssh2: drop two redundant null-terminations
• libssh2: error check and null-terminate in ssh_state_sftp_readdir_link()
• libssh2: fix EAGAIN return in ssh_state_auth_agent
• libssh2: fix return code for EAGAIN
• libssh2: use sockindex consistently
• libssh: acknowledge SSH_AGAIN in the SFTP state machine
• libssh: catch a resume point larger than the size
• libssh: clarify myssh_block2waitfor
• libssh: drop two unused assignments
• libssh: error on bad chgrp number
• libssh: error on bad chown number and store the value
• libssh: fix range parsing error handling mistake
• libssh: make atime and mtime cap the timestamp instead of wrap …