curl 8.22.0

curl / Docs / Releases / Changes in 8.22.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.21.0 all changes pending release

Changes in 8.22.0 - September 2 2026

8.22.0 8.22.0 Changes:

• gssapi: add support for Apple GSS Framework
• hardening: add API guards
• RFC 9421 HTTP Message Signatures support
• spnego: block NTLM fallback in SPNEGO negotiation
• TLS: drop support for TLS-SRP
• vquic: add option to use Apple fast UDP Bugfixes:
• altsvc: continue after unknown parameters
• asyn-thrdd: retry link-local ipv6 if missing scope id
• autotools: minor fixes and improvements
• build: always use local inet_pton()/inet_ntop() implementations
• build: assume POSIX select() is available
• build: clear Require.private for static-only builds in libcurl.pc
• build: drop dirent.h and opendir() detections on Windows
• build: drop detecting gettimeofday() on Windows
• build: drop superfluous STDC_HEADERS macro
• build: enable thread-safe getaddrinfo() for OpenBSD
• build: minor debug option message fixes/improvements
• build: require !NDEBUG for debug-enabled (aka development) builds
• build: strip duplicate spaces after Libs.private: in libcurl.pc
• build: strip trailing spaces from libcurl.pc
• cd2nroff: fix backslashes for 4-space indent lines
• cd2nroff: stricter checks for asterisks for italics
• cf-ngtcp2-cmn: de-duplicate ngtcp2_conn_client_new() call code
• cf-ngtcp2-cmn: initialize new callback ptr for ngtcp2 1.24.0+
• cf-socket: avoid broken NetBSD SOCK_NONBLOCK
• cf-socket: disable TCP SYN retransmissions for localhost on Windows
• cfilters: fix event-based connection shutdown
• clock: save one call
• cmake/FindLibgsasl: fix to set LIBGSASL_VERSION with pkg-config detection
• cmake: check libgsasl version at configure time
• cmake: dedupe expressions into local vars in cmake_uninstall.in.cmake
• cmake: fix not to build tunits when BUILD_CURL_EXE=OFF
• cmake: flatten build tree, tidy up base dir variables
• cmake: minor improvements to cmake_uninstall.in.cmake
• cmake: optimize OpenSSL fork detection
• cmake: replace remove command with rm and pass arg safely
• cmake: robustify base path in local file reference
• cmake: stop probing unused float.h for STDC_HEADERS
• cmake: use built-in variable and target property dump functions with CMake 4.5+
• config-riscos.h: delete handcrafted RISC OS config header, in favor of autotools
• config-win32.h: drop UWP, c-ares, simplify more
• config-win32.h: limit use to MSVC IDE Project builds
• configure: clarify --enable-debug option
• configure: fix misleading error messages
• configure: link -lcrypt32 instead of -lm for wolfSSL on Windows
• configure: only check in the watt library if WATT_ROOT is set
• configure: remove double check for GnuTLS
• configure: set ldap lib to no by default for non-finds
• conncache: apply multi limits to transfers using a shared pool
• conncache: conn upkeep/alive: move and enhance
• conncache: connection alive checks intervals
• conncache: don't assume curl_off_t increment wrap-around
• conncache: guess maxconnects different
• connect: connection close tweaks
• connect: only set connect timer on first socket
• connection reuse: age check
• connection reuse: check SSL configs when doing a scheme upgrade
• connections: use admin handles only for maintenance
• content_encoding: exact-match the identity transfer-coding token
• content_encoding: give a clear error on multi-member gzip
• cookie: cookies set for an exact PSL domain is host-only
• cookie: improve TAB handling
• cookie: refuse to load cookies set against a PSL domain
• CREDENTIALS.md: remove comment about empty user/pass
• ctype: exclude control bytes from ISPRINT and ISGRAPH
• curl: help category cleanups
• curl_gssapi: document/update feature availability
• curl_threads: always use native threads/mutex on Windows
• curl_trc: remove unused expire timers
• curl_url_set.md: expand the CURLU_NO_AUTHORITY description
• curl_ws_meta.md: polish and better vocabulary
• CURLOPT_HEADERFUNCTION.md: document folded header unfolding
• CURLOPT_SOCKOPTFUNCTION.md: ALREADY_CONNECTED does not work for HTTP/3
• CURLOPT_SSH_*_KEYFILE: used for setting up, then no more
• CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication'
• CURLOPT_USERNAME.md: ambient username caveats
• CURLSHOPT_(UN)SHARE.md: do not modify shares while in use
• curlx_inet_ntop: return CURLcode, drop setting errno
• curlx_inet_pton: drop setting errno on error
• DEPRECATE.md: HTTP/2 Server Push gets removed in March 2027
• dict: avoid busy-loop in sendf() when the socket is not writable
• dist: fix to drop test bundle .c files from the source tarball
• dnsd: fix bounds check in read_https_alpn_part()
• docs/INTERNALS.md -> docs/DEPENDENCIES.md
• docs: clarify that cookies need domain set to match
• docs: connection reuse behavior for socket callbacks
• docs: make 5 example snippets compile cleanly with clang
• docs: mention possible auth option conflicts
• docs: remove doubled word in SECURITY-ADVISORY.md
• DoH: improvements
• easy: fix unused global on non-Windows
• easy_lock: silence portability-no-assembler with clang-tidy 23.1.0+
• FAQ: correct an option typo
• file: support directory listing on Windows
• filter: change time reporting
• FTP: fix TLS session reuse on the data connection
• ftp: reject control bytes in ACCT and alternative-to-user
• gitignore: maintenance updates
• gopher: fix partial sends of CRLF
• gopher: reject CR and LF in the selector
• h2 push: use squeaky clean easy handle
• h2: bootstrap max streams from multi handle if in use
• h3-proxy: fix NULL deref when non-:status header arrives before :status
• Happy Eyeballing v3: resolution delay of 25ms
• header api: add guards
• headers: name the arguments the way the definitions name them
• HISTORY.md: PSL support in 2015
• HISTORY: add when c-ares support was introduced (2004)
• HISTORY: September 1999: started using CVS
• hostip: only cache negative resolves for authoritative answers
• hsts: only match the exact strings
• http digest: tie peer/credentials on input
• http2: make server push transfers inherit share from parent
• http2: remove assert in ingress processing
• http: avoid length underflow in Curl_compareheader
• http: custom Authorization: header overrides Negotiate
• http: fix non-tunneling proxy hostname use
• http: stop dropping large custom headers
• http: trim custom header name before the Authorization drop
• httpsrr: DoH with HTTPS, fix response handling
• idn: restore MultiByteToWideChar() MB_ERR_INVALID_CHARS flag
• imap: APPEND CRLF fix
• include: include <sys/select.h> when building for modern Linux.
• INSTALL.md: add building-from-source overview section
• INTERNALS.md: require quiche 0.20.0+
• ipv6 scope_id: set from first peer
• keylog: add a random size argument to Curl_tls_keylog_write()
• ldap: base64-encode LDIF values beginning with colon or less-than
• ldap: reject control characters in URL-decoded filter values
• ldap: support empty username and password
• ldap: support insecure mode for Windows native LDAP
• lib1587: fix gcc -Wconversion with LibreSSL on Windows, test in CI
• lib2405: adjust for non-threaded builds
• lib: add "Curl_" prefix to two global functions
• lib: add multi_wakeup_internal
• lib: drop unused system_win32.h includes
• lib: fix 'ns' -> 'us' in trace messages
• lib: new easy option string storage
• lib: optimize struct layouts for reduced memory usage
• lib: ratelimit timestamps
• lib: silence gcc-16 compiler warnings -Wmaybe-uninitialized
• lib: update mentions of the legacy "sessionhandle"
• libcurl.md: emphasize that the output needs checking
• libcurl.pc: add License tag
• libcurl.pc: add Copyright tag to the pkgconf file
• libcurl.pc: add the Link.ABI and Source tags
• macos sectrust: fail ocsp verify when not builtin
• Makefile.am: improve etags
• mbedtls: enforce verifyhost when verifypeer is disabled
• mbedtls: replace memset() with psa_hash_operation_init()
• md5: replace magic numbers with MD5_DIGEST_LEN
• mime.c: avoid integer overflow in base64 size calculation
• mime: reject CR and LF in mail part name and filename
• mod_curltest: fix compiler warnings
• mprintf: acknowledge %F
• mprintf: avoid never-ending loop for positive-infinite
• mprintf: fix long double output
• mqtt: reject control bytes in the topic
• multi: cap expire times to INT_MAX internally
• multi: forbid curl_easy_pause from within multi socket callback
• multi: hold timeout values in 'int' instead of 'long'
• multi: remove #if 0'ed code that uses old struct
• multi: shrink expire timer indices
• multi: timeout improvements
• multi: use index list for expire timeouts
• multi: xfer table initial size and growth
• multihandle: move two struct fields
• ngtcp2+openssL: fix early data
• ngtcp2: avoid NULL deref in cf_ngtcp2_send
• ngtcp2: clean up after ngtcp2 in curl_global_cleanup
• ngtcp2: let verify failures win over expiry processing errors
• openldap: handle Curl_sasl_continue() returns better
• openssl+sectrust: fix session reuse
• openssl+sectrust: move session verified set into result check
• openssl: avoid conn reuse if provider is used
• openssl: avoid strlen() on the data from OpenSSL
• openssl: aws-lc ocsp workaround
• openssl: drop unused pre-OpenSSL3 ctx_option_t typedef
• openssl: fix DER buffer leak in Apple SecTrust verification
• openssl: no server cert is only okay if also not pinned
• openssl: prefer modern API flavors for EVP_MD_CTX new/free
• openssl: replace stray legacy API variant with EVP_DigestInit_ex()
• os400: port latest header files changes to ILE/RPG interface
• os400: rewrite upper ebcdic wrappers using dynbuf
• progress: cleanup, less memory
• protocol: simpler Curl_getn_scheme runs faster
• proxy: CONNECT trailers handling
• psl: update a comment to understandable English
• pytest: update two H3 tests for nghttp3 1.18.0+
• quic: upload improvements
• quiche: set the max field section size
• rtsp: refactor method handling and improve error checks
• runtests: allow comments in setenv section, merge sections in test433
• runtests: fix mode="warn" tests passing unconditionally, fix test 1752
• runtests: flush cached test parts when (re)loading a file
• runtests: restore -k option and actively process as no-op
• sasl: fix zero-length response encoding
• schannel: add ALPN support for mingw-w64 <9 and <VS2015
• schannel: clear PFX password before free
• schannel: fix ALPN erroneously disabled
• schannel: fix error check logic in get_client_cert() file reader
• schannel: refresh stream sizes after renegotiation
• schannel: reuse the send buffer
• schannel: shut off experimental TLS 1.3 support for Win 10
• scorecard: fix max_upload init value in ul_parallel()
• scripts/badwords.txt: do not recommend using 'will' in rewrites
• scripts: replace/extend -- with --end-of-options in git commands
• scripts: use end-of-options marker in cd, mkdir, mv, sha256sum commands
• servers: fix HANDLE leak in UWP builds
• servers: fix to reverse SA_RESTART option for sigaction() on modern codepath
• setopt: allow setting a referer from CURLINFO_REFERER
• setopt: error for CURLOPT_SHARE when easy handle is used
• setopt: make NULL CURLOPT_AWS_SIGV4 disable aws-sigv4 auth
• setopt: return OK earlier for the deprecated h2 dep options
• share unlink: forget connection
• smtp: reject CR and LF in the envelope address
• spacecheck: cap number of lines per file
• spnego_sspi: drop redundant UNICODE branch
• spnego_sspi: pass channel bindings on initial context
• src: safely clear certain buffers
• sshserver.pl: bump an sshd config to use its modern name
• ssls: fix potential memory leak on import
• sspi: add local helper macro to avoid UNICODE branching
• sspi: enable channel-binding in mingw-w64 <9 builds
• strcase: inline the raw case conversions
• sws: allow connection-monitor to log all disconnects …