# curl 8.18.0

- Product: curl (https://whatsnew.fyi/product/curl)
- Vendor: curl
- Date: 2026-01-07
- Version: 8.18.0
- Original notes: https://curl.se/ch/8.18.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.18.0
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **removed** — drop support for VS2008 (Windows)
- **removed** — drop Windows CE / CeGCC support
- **removed** — drop support for GnuTLS < 3.6.5
- **added** — implement CURLOPT_CAINFO_BLOB in GnuTLS
- **changed** — bump minimum OpenSSL version to 3.0.0
- **fixed** — fix ancient evaluation in apple sectrust
- **fixed** — handle Curl_dnscache_mk_entry() OOM error in asyn-ares
- **fixed** — fix Curl_async_getaddrinfo() on systems without getaddrinfo
- **fixed** — fix progress meter in parallel mode
- **fixed** — avoid strcpy in content_encoding
- **fixed** — return proper error on OOM in cookie handling
- **fixed** — refuse headers with CR, LF or null bytes in curl_quiche
- **fixed** — make Curl_sasl_decode_mech compare case insensitively
- **changed** — support folded headers in CONNECT responses in cf-h1-proxy
- **fixed** — fix DES_* symbols for some wolfSSL builds in curl_ntlm_core
- **fixed** — enable Win10 TCP_KEEP* options with old SDKs in cf-socket
- **fixed** — limit use of TCP_KEEP* to Windows 10.0.16299+ at runtime in cf-socket
- **changed** — increase minimum stack size for tool_main in AmigaOS
- **fixed** — fix LargeFile feature display on Windows in autotools
- **changed** — add nettle library detection via pkg-config for GnuTLS in autotools

curl / Docs / Releases / Changes in 8.18.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.17.0 all changes 8.19.0 🠲
#### Changes in 8.18.0 - January 7 2026
8.18.0
8.18.0
Changes:
- build: drop support for VS2008 (Windows)
- build: drop Windows CE / CeGCC support
- gnutls: drop support for GnuTLS < 3.6.5
- gnutls: implement CURLOPT_CAINFO_BLOB
- openssl: bump minimum OpenSSL version to 3.0.0
Bugfixes:
- _PROGRESS.md: add the E unit, mention kibibyte
- alt-svc: more flexibility on same destination
- altsvc: accept ma/persist per alternative entry
- altsvc: make it one malloc instead of three per entry
- AmigaOS: increase minimum stack size for tool_main
- apple sectrust: fix ancient evaluation
- apple-sectrust: always ask when `native_ca_store` is in use
- asyn-ares: handle Curl_dnscache_mk_entry() OOM error
- asyn-ares: remove hostname free on OOM
- asyn-thrdd: fix Curl_async_getaddrinfo() on systems without getaddrinfo
- asyn-thrdd: release rrname if ares_init_options fails
- auth: always treat Curl_auth_ntlm_get() returning NULL as OOM
- autotools: add nettle library detection via pkg-config (for GnuTLS)
- autotools: drop autoconf <2.59 compatibility code (zz60-xc-ovr)
- autotools: fix LargeFile feature display on Windows (after prev patch)
- autotools: tidy-up `if` expressions
- badwords: add mistyped 'first', fix fallouts
- badwords: catch and fix threading-related words
- badwords: fix issues found in scripts and other files
- badwords: fix issues found in tests
- build: add build-level `CURL_DISABLE_TYPECHECK` options
- build: exclude clang prereleases from compiler warning options
- build: replace `-pedantic` with `-Wpedantic` when supported
- build: set `-Wno-format-signedness`
- build: tidy-up MSVC CRT warning suppression macros
- ccsidcurl: make curl_mime_data_ccsid() use the converted size
- cf-h1-proxy: support folded headers in CONNECT responses
- cf-https-connect: allocate ctx at first in cf_hc_create()
- cf-socket: drop feature check for `IPV6_V6ONLY` on Windows
- cf-socket: enable Win10 `TCP_KEEP*` options with old SDKs
- cf-socket: limit use of `TCP_KEEP*` to Windows 10.0.16299+ at runtime
- cf-socket: return OOM error if socket() fails due to OOM
- cf-socket: trace ignored errors
- cfilters: make conn_forget_socket a private libssh function
- checksrc.pl: detect assign followed by more than one space
- cmake: adjust defaults for target platforms not supporting shared libs
- cmake: define dependencies as `IMPORTED` interface targets
- cmake: delete unused file `CMake/CMakeConfigurableFile.in`
- cmake: disable `CURL_CA_PATH` auto-detection if `USE_APPLE_SECTRUST=ON`
- cmake: fix `ws2_32` reference in `curl-config.cmake`
- cmake: honor `CURL_DISABLE_INSTALL` and `CURL_ENABLE_EXPORT_TARGET`
- cmake: replace deprecated `OPENSSL_FOUND` with `OpenSSL_FOUND`
- cmake: replace deprecated `PERL_FOUND` with `Perl_FOUND`
- cmake: save and restore `CMAKE_MODULE_PATH` in `curl-config.cmake`
- cmake: set found status to OFF when not found (for compression deps)
- code: minor indent fixes before closing braces
- CODE_STYLE.md: sync banned function list with checksrc.pl
- compressed.md: might generate a huge amount of bytes
- config-win32.h: delete obsolete, non-Windows comments
- config-win32.h: drop unused/obsolete `CURL_HAS_OPENLDAP_LDAPSDK`
- config2setopts: add space in cookie header with multiple -b
- config2setopts: bail out if curl_url_get() returns OOM
- config2setopts: exit if curl_url_set() fails on OOM
- configure: delete unused variable
- conncache: silence `-Wnull-dereference` on gcc 14 RISC-V 64
- conncontrol: reuse handling
- connect: reshuffle Curl_timeleft_ms to avoid 'redundant condition'
- connection: attached transfer count
- content_encoding: avoid strcpy
- cookie. return proper error on OOM
- cookie: allocate the main struct once cookie is fine
- cookie: flush better
- cookie: only keep and use the canonical cleaned up path
- cookie: propagate errors better, cleanup the internal AP

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.18.0.html]_